Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/supabase/README.md

@@ -0,0 +1,16 @@
+# supabase
+
+The `supabase` module of the mesh catalogue: runs the container image `timberio/vector`; runs the container image `supabase/postgres`; runs the container image `supabase/logflare`; runs the container image `kong`; runs the container image `supabase/gotrue`; runs the container image `postgrest/postgrest`; runs the container image `supabase/realtime`; runs the container image `darthsim/imgproxy`; runs the container image `supabase/storage-api`; runs the container image `supabase/postgres-meta`; runs the container image `supabase/edge-runtime`; runs the container image `supabase/studio`; runs the container image `supabase/supavisor`.
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `${dir:state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:state}/db-init`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:state}/functions-main`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:db-data}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:state}/dumps`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:db-config}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:storage}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:functions}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).

modules/supabase/module.json

@@ -113,47 +113,55 @@
       "id": "state",
       "type": "directory",
       "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
     },
     {
       "id": "db-init",
       "type": "directory",
       "path": "${dir:state}/db-init",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
     },
     {
       "id": "functions-main-dir",
       "type": "directory",
       "path": "${dir:state}/functions-main",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
     },
     {
       "id": "db-data",
       "type": "directory",
       "mode": "0700",
-      "owner": "105:106"
+      "owner": "105:106",
+      "unknown": "program"
     },
     {
       "id": "dumps",
       "type": "directory",
       "path": "${dir:state}/dumps",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "program"
     },
     {
       "id": "db-config",
       "type": "directory",
       "mode": "0755",
-      "owner": "105:106"
+      "owner": "105:106",
+      "unknown": "program"
     },
     {
       "id": "storage",
       "type": "directory",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
     },
     {
       "id": "functions",
       "type": "directory",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
     },
     {
       "id": "settings",