Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/ssh-client/README.md

@@ -83,7 +83,7 @@ ADR 0417 (issue 1020) adds:
   `ssh_client_check` reports a failed last sweep, and a listed move with nothing at its destination, as a
   problem.
 
-No other module declares a path under `~/.ssh` (ADR 0415 §6): the catalogue's `checks/sshdir` fails one
+No other module declares a path under `~/.ssh` (ADR 0415 §6): the catalogue's `checks/owned` (ADR 0422 §8) fails one
 that does.
 
 So the predecessor's `config.d/mesh`, `config.bak-*`, `known_hosts.old`, `removed-*` and
@@ -132,3 +132,10 @@ The tests use a temporary home and a fake runner, with public keys made for the
   itself), what it moves, what it leaves and names, a file being written, another file system, and the
   list written before each move;
 - that the tools served are the manifest's `tools`.
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `~/.ssh`: the module's own sweep moves everything it does not know into a kept folder, listing each move first and failing loudly when one cannot be made (ADR 0415, ADR 0417); value `module` (ADR 0422 §3).
+- `~/.ssh/config.d`: the same sweep covers it; value `module` (ADR 0415, ADR 0417).

modules/ssh-client/cmd/ssh-client-tools/templates_test.go

@@ -156,7 +156,6 @@ func TestForgeFilesRenderFromTheBoundValues(t *testing.T) {
 		t.Errorf("10-forge = %q, want %q", got, want)
 	}
 
-	resourceByPath(t, home+"/.config/git") // the directory
 	g := resourceByPath(t, home+"/.config/git/config")
 	if g["into"] != "block" {
 		t.Errorf("git config is %v, want a block", g["into"])

modules/ssh-client/module.json

@@ -34,14 +34,16 @@
       "type": "directory",
       "path": "${machine:account-home}/.ssh",
       "owner": "${machine:account}",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "module"
     },
     {
       "id": "config-d",
       "type": "directory",
       "path": "${machine:account-home}/.ssh/config.d",
       "owner": "${machine:account}",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "module"
     },
     {
       "id": "config",
@@ -70,13 +72,6 @@
       "mode": "0600",
       "template": "files/forge"
     },
-    {
-      "id": "git-config-dir",
-      "type": "directory",
-      "path": "${machine:account-home}/.config/git",
-      "owner": "${machine:account}",
-      "mode": "0755"
-    },
     {
       "id": "git-config",
       "type": "file",