Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/powerlevel10k/module.json

@@ -8,14 +8,17 @@
       "type": "archive",
       "path": "${machine:account-home}/.local/share/powerlevel10k",
       "owner": "${machine:account}",
-      "artifact": "theme"
+      "artifact": "theme",
+      "unknown": "move-out",
+      "knows": ["powerlevel9k.zsh-theme.zwc", "powerlevel10k.zsh-theme.zwc", "internal/p10k.zsh.zwc", "internal/icons.zsh.zwc", "internal/configure.zsh.zwc", "internal/worker.zsh.zwc", "internal/parser.zsh.zwc", "gitstatus/gitstatus.plugin.zsh.zwc", "gitstatus/install.zwc"]
     },
     {
       "id": "configuration",
       "type": "archive",
       "path": "${machine:account-home}/.config/powerlevel10k",
       "owner": "${machine:account}",
-      "artifact": "configuration"
+      "artifact": "configuration",
+      "unknown": "move-out"
     }
   ],
   "items": [