Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/powerlevel10k/README.md

@@ -21,6 +21,9 @@ release's contents, and update the version here and in the shell code's comment.
 | `~/.local/share/powerlevel10k/` | the theme, unpacked from the `theme` archive | owned, whole |
 | `~/.config/powerlevel10k/p10k.zsh` | the prompt's configuration, unpacked from the `configuration` archive | owned, whole |
 
+Both directories are `unknown: move-out` (ADR 0422): they hold only what the archives declare, and anything
+else found in them is moved out by the node-engine, never deleted.
+
 The configuration is today's `~/.p10k.zsh`, byte for byte. It is the predecessor's file, and was
 identical on every machine. It ships as an archive of one file rather than as an inline file. At
 86 KB, inline content would ride in every declaration the node receives, and would be unreadable
@@ -44,3 +47,10 @@ operator's `.zshrc` has its cache line commented out today, and the configuratio
 - **Moving from the predecessor:** once this module is assigned, `~/.zsh/themes/powerlevel10k` and
   `~/.p10k.zsh` are no longer read, and the operator removes them, once (ADR 0182; the zsh module's
   README lists the lines to delete from `.zshrc`).
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `~/.local/share/powerlevel10k`: holds only what this module declares and the nine `.zwc` files the theme compiles into its own folder at every zsh start (`powerlevel9k.zsh-theme.zwc`, `powerlevel10k.zsh-theme.zwc`, `internal/{p10k,icons,configure,worker,parser}.zsh.zwc`, `gitstatus/gitstatus.plugin.zsh.zwc`, `gitstatus/install.zwc`; `powerlevel10k.zsh-theme` lines 62-70); anything else is moved out by the node-engine to `~/.local/state/mesh-moved/powerlevel10k/` with a list, never deleted (ADR 0422 §4).
+- `~/.config/powerlevel10k`: holds only what this module declares; anything else is moved out by the node-engine to `~/.local/state/mesh-moved/powerlevel10k/` with a list, never deleted (ADR 0422 §4).

modules/powerlevel10k/module.json

@@ -8,14 +8,17 @@
       "type": "archive",
       "path": "${machine:account-home}/.local/share/powerlevel10k",
       "owner": "${machine:account}",
-      "artifact": "theme"
+      "artifact": "theme",
+      "unknown": "move-out",
+      "knows": ["powerlevel9k.zsh-theme.zwc", "powerlevel10k.zsh-theme.zwc", "internal/p10k.zsh.zwc", "internal/icons.zsh.zwc", "internal/configure.zsh.zwc", "internal/worker.zsh.zwc", "internal/parser.zsh.zwc", "gitstatus/gitstatus.plugin.zsh.zwc", "gitstatus/install.zwc"]
     },
     {
       "id": "configuration",
       "type": "archive",
       "path": "${machine:account-home}/.config/powerlevel10k",
       "owner": "${machine:account}",
-      "artifact": "configuration"
+      "artifact": "configuration",
+      "unknown": "move-out"
     }
   ],
   "items": [

modules/powerlevel10k/test/module.test.ts

@@ -22,8 +22,8 @@ test("the configuration archive holds the prompt's configuration and nothing els
 
 test("both are unpacked under the account's home, owned by the account", () => {
   const byId = Object.fromEntries(m.resources.map((r: { id: string }) => [r.id, r]));
-  assert.deepEqual(byId.theme, { id: "theme", type: "archive", path: "${machine:account-home}/.local/share/powerlevel10k", owner: "${machine:account}", artifact: "theme" });
-  assert.deepEqual(byId.configuration, { id: "configuration", type: "archive", path: "${machine:account-home}/.config/powerlevel10k", owner: "${machine:account}", artifact: "configuration" });
+  assert.deepEqual(byId.theme, { id: "theme", type: "archive", path: "${machine:account-home}/.local/share/powerlevel10k", owner: "${machine:account}", artifact: "theme", unknown: "move-out", knows: ["powerlevel9k.zsh-theme.zwc", "powerlevel10k.zsh-theme.zwc", "internal/p10k.zsh.zwc", "internal/icons.zsh.zwc", "internal/configure.zsh.zwc", "internal/worker.zsh.zwc", "internal/parser.zsh.zwc", "gitstatus/gitstatus.plugin.zsh.zwc", "gitstatus/install.zwc"] });
+  assert.deepEqual(byId.configuration, { id: "configuration", type: "archive", path: "${machine:account-home}/.config/powerlevel10k", owner: "${machine:account}", artifact: "configuration", unknown: "move-out" });
 });
 
 // The zsh code is an item of the collection shell:zsh:normal, its text a template in files/ (ADR 0348, 0349).