Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/picom/README.md

@@ -59,7 +59,7 @@ A picom a tool starts runs under the account's own service manager (`systemd-run
   in place. It probably fails to start on that machine's GPU. `picom_restart` with `hard` after
   assignment answers with what happened. The next step is the `picom` user unit's journal.
 
-## What it leaves as found
+## What lies outside its directory
 
 The window manager's own `exec --no-startup-id picom` line belongs to the `i3` module's configuration,
 which no longer carries it. Nothing else of picom's lies outside the directory this module owns.
@@ -78,3 +78,9 @@ which no longer carries it. Nothing else of picom's lies outside the directory t
   the module.
 - `xorg-xprop` is declared here because the `xorg` module does not install it. If `xorg` comes to
   declare it, it leaves this module, since a package is declared once per node.
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `~/.config/picom`: holds only what this module declares; anything else is moved out by the node-engine to `~/.local/state/mesh-moved/picom/` with a list, never deleted (ADR 0422 §4).

modules/picom/module.json

@@ -55,7 +55,8 @@
       "type": "directory",
       "path": "${machine:account-home}/.config/picom",
       "owner": "${machine:account}",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "move-out"
     },
     {
       "id": "configuration",