mesh-cli: say an outcome not known, and hold the module to placing one file (review of hq ADR 0272)

A line whose answer did not come in time is said as possibly run, with
its call, never as nothing having run. A test holds the module to one
archive resource unpacking one compiled Go bundle into /usr/local/bin.
The README says the MESH_VERB refusal is a courtesy and the controller is
the gate. SDK pinned at the go/cli branch's newest commit until go/v0.1.9.

modules/mesh-cli/README.md

@@ -35,9 +35,11 @@ everywhere say `mesh-cli`. In interactive zsh the alias hides any other `nox` (A
      It meets every refusal of the generic `command` verb, and a change made at the terminal alone is refused with
      the reason.
    - **refused**: any other account, root included. Run it as yourself, not under `sudo`.
-3. `mesh-cli` prints standard output and standard error as the command wrote them, says why a line was not the
-   terminal or was refused, says when the output was cut to fit one bus message, and exits with the command's
-   status.
+3. A line still running after ten seconds is followed by its call until it ends. `mesh-cli` prints standard
+   output and standard error as the command wrote them, says why a line was not the terminal or was refused, says
+   when the output was cut to fit one bus message, and exits with the command's status. When no answer comes in
+   time it says the line may have run and names its call; "nothing ran" is said only of a line no controller
+   took.
 
 A process that runs for a verb (it carries `MESH_VERB`) is refused before anything is asked: a verb is never the
 operator.
@@ -49,11 +51,14 @@ operator.
   Give settings inline: `nox settings set <module> "$(cat settings.json)" --node <node>`.
 - **No streaming.** The answer arrives when the command ends, within the controller's bound on a call (five
   minutes). Interrupting `mesh-cli` stops the wait, not the command.
+- **The `MESH_VERB` refusal is a courtesy.** A verb's process is refused before asking, but the gate is the
+  controller: it judges the account the node-engine vouches for, whatever the program says.
 - **No other node is the terminal.** Phase 2 of ADR 0272 adds a node whose agents run under an account of their
   own (ADR 0266), judged unable to become root.
 
 ## Tests
 
-`go test ./...`: the line is asked as given and the answer printed with its exit; a reason, a refusal and a cut
+`go test ./...`: the module places exactly one file (one archive resource, one Go bundle compiled to the binary
+alone); the line is asked as given and the answer printed with its exit; a reason, a refusal, a cut and an outcome not known
 are said and a refusal never exits 0; a verb's process is refused before asking; an engine that does not answer
 is said.