Run mesh-knowledge's watch as the account the health tool reads as (hq issue 479)

The watch ran as root and wrote its verdict root's and 0600 into the state
directory, which the mesh gives to the account the runtime runs the bundle as;
knowledge_health could not open it, so the module read unhealthy with nothing
wrong. Run watch as that account, as zfs's watch does.

modules/mesh-knowledge/README.md

@@ -131,7 +131,8 @@ the consolidated schema for a fresh database is `schema.sql`. A test holds the t
   refuses to serve while the schema is behind.
 - **`prepare`** (run once): brings the schema to this version.
 - **`keep`** (judged by its unit): judges the whole record set every five minutes and keeps the findings.
-- **`watch`** (judged by `knowledge_health`): every minute, reads whether the database serves and what the
+- **`watch`** (judged by `knowledge_health`, run as the machine's account, the one the runtime runs the bundle
+  as, so the tool can read what it writes): every minute, reads whether the database serves and what the
   findings say, and leaves its verdict in `${dir:state}/health.json`. That is the file the health tool answers
   from. A verdict older than three minutes is unhealthy.
 

modules/mesh-knowledge/cmd/mesh-knowledge/manifest_test.go

@@ -124,6 +124,12 @@ func TestItsProcessesAreThePreparationTheActAndTheJudge(t *testing.T) {
 	if watch["env"].(map[string]any)["MESH_KNOWLEDGE_STATUS"] != m.Build.Artifacts[0].Env["MESH_KNOWLEDGE_STATUS"] {
 		t.Fatal("watch writes another status file than the health tool reads")
 	}
+	// The health tool reads the status file as the account the runtime runs the bundle as, and the mesh gives that
+	// account the state directory (and nothing a process writes there later). A watch running as root wrote the
+	// file root's, 0600, and the tool could not open it (hq issue 479): watch runs as that account, as zfs's does.
+	if watch["user"] != "${machine:account}" {
+		t.Fatalf("watch runs as %v, not as the account the health tool reads its verdict as", watch["user"])
+	}
 	settings := byID["settings"]
 	var s Settings
 	if err := json.Unmarshal([]byte(settings["content"].(string)), &s); err != nil || s.JudgeModel == "" || s.ReservedFor != "168h" {

modules/mesh-knowledge/module.json

@@ -145,6 +145,7 @@
         "./mesh-knowledge",
         "watch"
       ],
+      "user": "${machine:account}",
       "env": {
         "DATABASE_URL_FILE": "${dir:state}/database.url",
         "MESH_KNOWLEDGE_STATUS": "${dir:state}/health.json"