Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/claude-code/README.md

@@ -10,10 +10,13 @@ Two directories, declared, so the mesh refuses a second module owning either:
 - `/etc/claude-code`, the agent's machine-wide managed directory, root's, `0755`.
 - `~/.claude` under the home of the account agents run as (the operator's, unless the machine names an agent
   account of its own), that account's, `0700`. The module owns the directory —
-  that it exists, who owns it, its mode — and of what is inside only what it writes. Everything else
-  in it (history, projects, local settings, a person's own rules and skills) is the person's
-  and is never read or written (hq ADR 0182) — but for each project's memory folder, which the module
-  carries between nodes (hq ADR 0343, below). Unassigned, the module leaves the directory: the host
+  that it exists, who owns it, its mode — and of what is inside only what it writes. What else is in
+  it (history, projects, local settings, a person's own rules and skills) is the person's, and the
+  directory is `unknown: module` (ADR 0422 §7): the module's own process decides what to do with a file
+  it did not write. Today that process carries each project's memory folder between nodes (hq ADR 0343,
+  below) and reads the home's items for its status tool; the reactions ADR 0273 decides (drift raised as a
+  condition, `home-copies`, unlisted entries raised) are not built yet (issue 1030), and until then nothing
+  else in it is moved. Unassigned, the module leaves the directory: the host
   removes a directory only when it is empty.
 
 And, for where the agent runs as an account of its own (hq ADR 0266):
@@ -353,3 +356,11 @@ is written. The same sudo starts the helper as the agent's account, where there
 Go, one binary (`cmd/claude-code`) the node's runtime launches. Tested with `go test ./...`; the managed
 instruction file is held to the TypeScript renderer it replaced (`testdata/rendered-by-typescript.json`),
 and the sealed box is the licence manager's own format.
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `/etc/claude-code`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `~/.claude`: value `module` (ADR 0422 §7). The module's process carries each project's memory folder (ADR 0343) and reads the home's items for its status tool; nothing else in it is moved. The reactions ADR 0273 decides (drift raised as a condition, `home-copies`, unlisted entries raised) are not built yet (issue 1030).
+- `${dir:state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).

modules/claude-code/module.json

@@ -154,7 +154,8 @@
       "id": "managed",
       "type": "directory",
       "path": "/etc/claude-code",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
     },
     {
       "id": "start",
@@ -182,14 +183,16 @@
       "type": "directory",
       "path": "${machine:agent-home}/.claude",
       "mode": "0700",
-      "owner": "${machine:agent-account}"
+      "owner": "${machine:agent-account}",
+      "unknown": "module"
     },
     {
       "id": "state",
       "type": "directory",
       "mode": "0700",
       "owner": "${machine:account}",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
     },
     {
       "id": "facts",