systemd: the journal verb reads a window, and failed is the seat's verb

An incident is read for the minutes it happened in (the operator's direction
2026-10-07): journal takes since, until, priority and a fixed-string match.
Every value is one word of journalctl's argv, held to the forms journalctl
reads, so nothing reaches a shell or is read as an option under sudo. What
the unit printed of a secret is redacted, as docker_logs does, before the
match is applied, so a match cannot find one.

systemd_failed becomes the seat's failed, with an optional scope. Needs the
controller's seat with these verbs (mesh-controller, same branch): an older
controller refuses a claim serving a verb its seat does not promise.

modules/systemd/cmd/systemd-tools/client_test.go

@@ -97,7 +97,7 @@ func TestTheUserScopeIsPlainUserWithTheAccountsRuntimeDirectoryAndBus(t *testing
 	if !strings.Contains(env, "XDG_RUNTIME_DIR=/run/user/1234") || !strings.Contains(env, "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1234/bus") || !strings.Contains(env, "HOME=/h") {
 		t.Fatalf("%v", calls[0].env)
 	}
-	if _, err := m.Journal(User, "watcher.service", 10); err != nil {
+	if _, err := m.Journal(User, "watcher.service", JournalQuery{Lines: 10}); err != nil {
 		t.Fatal(err)
 	}
 	if calls[1].cmd != "journalctl" || calls[1].args[0] != "--user" {
@@ -242,7 +242,7 @@ func TestAUnitsNameIsNeverAnOption(t *testing.T) {
 	}
 }
 
-// The manifest owns the systemd package, claims the seat's eight verbs, and lists exactly the tools served.
+// The manifest owns the systemd package, claims the seat's nine verbs, and lists exactly the tools served.
 func TestTheManifestOwnsThePackageAndListsWhatIsServed(t *testing.T) {
 	raw, err := os.ReadFile("../../module.json")
 	if err != nil {