Run mesh-knowledge's watch as the account the health tool reads as (hq issue 479)

The watch ran as root and wrote its verdict root's and 0600 into the state
directory, which the mesh gives to the account the runtime runs the bundle as;
knowledge_health could not open it, so the module read unhealthy with nothing
wrong. Run watch as that account, as zfs's watch does.

modules/mesh-knowledge/cmd/mesh-knowledge/manifest_test.go

@@ -124,6 +124,12 @@ func TestItsProcessesAreThePreparationTheActAndTheJudge(t *testing.T) {
 	if watch["env"].(map[string]any)["MESH_KNOWLEDGE_STATUS"] != m.Build.Artifacts[0].Env["MESH_KNOWLEDGE_STATUS"] {
 		t.Fatal("watch writes another status file than the health tool reads")
 	}
+	// The health tool reads the status file as the account the runtime runs the bundle as, and the mesh gives that
+	// account the state directory (and nothing a process writes there later). A watch running as root wrote the
+	// file root's, 0600, and the tool could not open it (hq issue 479): watch runs as that account, as zfs's does.
+	if watch["user"] != "${machine:account}" {
+		t.Fatalf("watch runs as %v, not as the account the health tool reads its verdict as", watch["user"])
+	}
 	settings := byID["settings"]
 	var s Settings
 	if err := json.Unmarshal([]byte(settings["content"].(string)), &s); err != nil || s.JudgeModel == "" || s.ReservedFor != "168h" {