Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/route-adapter/README.md

@@ -179,3 +179,10 @@ provider helper for `route`, with no credential. A consumer of a route whose tem
 (a handed gitea's origins file) is filled by its machine's client from this module's entry for it. The entry's values are
 the names the controller composed for that consumer, carried in its plan and copied unchanged: the public domain is
 placement, so only the controller can join a label to it. The adapter still writes the predecessor proxy's files.
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `${dir:state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `/var/lib/route-adapter/routes`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).

modules/route-adapter/module.json

@@ -58,13 +58,15 @@
       "id": "state",
       "type": "directory",
       "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
     },
     {
       "id": "routes-dir",
       "type": "directory",
       "path": "/var/lib/route-adapter/routes",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "program"
     },
     {
       "id": "config",