mesh-cli: say an outcome not known, and hold the module to placing one file (review of hq ADR 0272)

A line whose answer did not come in time is said as possibly run, with
its call, never as nothing having run. A test holds the module to one
archive resource unpacking one compiled Go bundle into /usr/local/bin.
The README says the MESH_VERB refusal is a courtesy and the controller is
the gate. SDK pinned at the go/cli branch's newest commit until go/v0.1.9.

modules/mesh-cli/cmd/mesh-cli/manifest_test.go

@@ -0,0 +1,56 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+)
+
+// **The archive places exactly one file, /usr/local/bin/mesh-cli** (review of novox/hq ADR 0272): one archive
+// resource, unpacking one artifact into /usr/local/bin, and that artifact a compiled Go bundle — the builder writes
+// such a bundle as its binary alone (`go build -o <out>/<binary>`), named mesh-cli — with nothing the runtime would
+// load or put beside it. A second file in the bundle, or a second resource writing there, fails here.
+func TestTheArchivePlacesExactlyOneFile(t *testing.T) {
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		Resources []map[string]any `json:"resources"`
+		Build     struct {
+			Artifacts []map[string]any `json:"artifacts"`
+		} `json:"build"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	if len(m.Resources) != 1 {
+		t.Fatalf("the module declares %d resources; it places one file", len(m.Resources))
+	}
+	r := m.Resources[0]
+	if r["type"] != "archive" || r["path"] != "/usr/local/bin" {
+		t.Fatalf("its resource is %v", r)
+	}
+	if len(m.Build.Artifacts) != 1 {
+		t.Fatalf("it builds %d artifacts", len(m.Build.Artifacts))
+	}
+	a := m.Build.Artifacts[0]
+	if a["name"] != r["artifact"] || a["kind"] != "bundle" || a["language"] != "go" || a["binary"] != "mesh-cli" ||
+		a["from"] != "cmd/mesh-cli" {
+		t.Fatalf("its artifact is %v, unpacked as %v", a, r["artifact"])
+	}
+	for _, extra := range []string{"loads", "env", "context", "files"} {
+		if _, has := a[extra]; has {
+			t.Fatalf("its artifact says %q, which would put more than the binary in the bundle or load it", extra)
+		}
+	}
+	entries, err := os.ReadDir(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, e := range entries {
+		if e.IsDir() {
+			t.Fatalf("cmd/mesh-cli holds a directory %s, which a build could carry into the bundle", e.Name())
+		}
+	}
+}