Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/dunst/README.md

@@ -6,8 +6,10 @@ The notifier as a module (novox/hq ADR 0208, research 026/05).
   The context menu its `dunstrc` calls is `rofi`, which the `rofi` module installs: two modules on one
   machine may not declare the same package, so a machine dunst serves also has `rofi` assigned.
 - Claims the mesh's `node-notifier` seat and serves its verbs `send` and `history`.
-- Owns `~/.config/dunst/dunstrc` and the directory `~/.config/dunst/dunstrc.d/`. Another module's
-  rule is that module's own file in the directory (ADR 0208 §4). dunst reads the directory after
+- Owns `~/.config/dunst/dunstrc` and the directory `~/.config/dunst/dunstrc.d/`. It holds what this
+  module declares and `50-slack.conf` (named in `knows`); any other file is moved out to
+  `~/.local/state/mesh-moved/dunst/` with a list, never deleted (ADR 0422). Another module's rule is that
+  module's own declared file in the directory (ADR 0208 §4). dunst reads the directory after
   `dunstrc`, so a drop-in outranks it.
 - **Starts nothing.** The package registers dunst with D-Bus, which starts it on the first
   notification, inside the account's service manager. There is no autostart line and no
@@ -97,10 +99,10 @@ count. The file keeps only the settings that differ from dunst's defaults.
 - `icon_path`, which named two directories of an icon theme that is not installed, is gone. The icon
   theme is looked up recursively.
 
-## What it leaves as found
+## What it keeps
 
-- `~/.config/dunst/dunstrc.d/50-slack.conf`, the Slack rule. It becomes the Slack module's own drop-in
-  when there is one, and until then it is the operator's file in a directory this module owns.
+- `~/.config/dunst/dunstrc.d/50-slack.conf`, the Slack rule, named in `knows`: kept until its owner exists.
+  It becomes the Slack module's own drop-in when there is one. Any other file in the folder is moved out.
 
 ## Migration (ADR 0182)
 
@@ -115,3 +117,10 @@ count. The file keeps only the settings that differ from dunst's defaults.
   unknown.
 - `dunst_rules` and the counts ask the running notifier. When none runs, the bus starts one, which
   needs a session to draw on.
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `~/.config/dunst`: holds only what this module declares; anything else is moved out by the node-engine to `~/.local/state/mesh-moved/dunst/` with a list, never deleted (ADR 0422 §4).
+- `~/.config/dunst/dunstrc.d`: holds only what this module declares and `50-slack.conf` (the Slack rule, kept until its owner exists); anything else is moved out by the node-engine to `~/.local/state/mesh-moved/dunst/` with a list, never deleted (ADR 0422 §4).

modules/dunst/module.json

@@ -56,14 +56,17 @@
       "type": "directory",
       "path": "${machine:account-home}/.config/dunst",
       "owner": "${machine:account}",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "move-out"
     },
     {
       "id": "dropins",
       "type": "directory",
       "path": "${machine:account-home}/.config/dunst/dunstrc.d",
       "owner": "${machine:account}",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["50-slack.conf"]
     },
     {
       "id": "configuration",