Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/route-proxy/README.md

@@ -91,3 +91,13 @@ A small Go program beside the proxy (`cmd/route-provider`) runs the SDK's provid
 and the offer says `"answered-by": "helper"`: a handed consumer (gitea's origins file) is filled by its machine's client
 from this module's entry, which carries the public names the controller composed for it. The module is **not** marked
 moved: its own files, `acme.env` and the broker secret, are composed as before, and the proxy itself is unchanged.
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `${dir:state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:mesh-state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `/var/lib/route-proxy/routes`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `/var/lib/route-proxy/acme`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `/var/lib/route-proxy/ca`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).

modules/route-proxy/cmd/route-provider/provider_test.go

@@ -102,7 +102,7 @@ func TestRouteProxyIsNotMovedAndKeepsItsOwnFiles(t *testing.T) {
 		t.Fatal(err)
 	}
 	sum := sha256.Sum256(pinned)
-	if got := hex.EncodeToString(sum[:]); got != "57a39de0943d8b33b9db6cb998ce97f8793602cca6cdfa5849c1c392390454a3" {
+	if got := hex.EncodeToString(sum[:]); got != "7e6b3a1721ccf89c042c41b77940a3b31f7632fa19e627f83fe1a65bc9a57ab1" {
 		t.Fatalf("route-proxy's own manifest changed: digest %s", got)
 	}
 	// The two acme templates are pinned the same way (issue 849): they are what the proxy's certificates are asked

modules/route-proxy/module.json

@@ -65,31 +65,36 @@
       "id": "state",
       "type": "directory",
       "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
     },
     {
       "id": "mesh-state",
       "type": "directory",
       "mode": "0700",
-      "place": "mesh"
+      "place": "mesh",
+      "unknown": "program"
     },
     {
       "id": "routes-dir",
       "type": "directory",
       "path": "/var/lib/route-proxy/routes",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "program"
     },
     {
       "id": "acme-cache",
       "type": "directory",
       "path": "/var/lib/route-proxy/acme",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "program"
     },
     {
       "id": "ca-dir",
       "type": "directory",
       "path": "/var/lib/route-proxy/ca",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
     },
     {
       "id": "acme-env",