xdg: keep the folders file trusted, so only the terminal sets the folders (hq issue 346)

user-dirs.dirs is shell assignments meant to be sourced by a shell, and a setting is pasted into it as
it is, so a folder of $HOME/x"; <command>; X=" set through the verb would add a command of the
caller's. With the file trusted again, the three folders are set at the controller's terminal alone
until settings are typed and quoted at render.

modules/xdg/README.md

@@ -47,6 +47,11 @@ default, so the mesh's layer is set before the first assignment (as `power`'s ar
 one file: the module has no merged file and no contribution, so issue 168 cannot carry them anywhere
 else.
 
+**They are set at the controller's terminal alone** (the file is trusted, unmarked; issue 339). A value is
+pasted into the file as it is, and the format is shell assignments meant to be sourced by a shell, so a
+value of `$HOME/x"; <command>; X="` would add a command of whoever set it (hq issue 346). Until settings
+are typed and quoted when written, no verb may set them.
+
 **Why `xdg-user-dirs-update` is disabled.** It runs at every login, from its XDG autostart entry, which
 `dex` starts. Measured on xdg-user-dirs 0.20 against a copy of the folders:
 

modules/xdg/cmd/xdg-tools/manifest_test.go

@@ -194,3 +194,21 @@ func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 		}
 	}
 }
+
+// The folders file stays trusted (unmarked), so its three settings are set at the controller's terminal
+// alone. A value is pasted into it as it is, and the format is shell assignments defined to be sourced
+// by a shell: `$HOME/x"; <command>; X="` would add a command of the caller's (hq issue 346). Until
+// settings are typed and quoted at render, no verb may set them.
+func TestTheFoldersFileStaysTrustedUntilSettingsAreQuoted(t *testing.T) {
+	m, _ := readManifest(t)
+	for _, r := range m.Resources {
+		if r["id"] != "user-dirs" {
+			continue
+		}
+		if _, marked := r["trusted"]; marked {
+			t.Fatal("user-dirs.dirs carries a trusted marking: its settings are the terminal's alone (hq issue 346)")
+		}
+		return
+	}
+	t.Fatal("no user-dirs resource")
+}

modules/xdg/module.json

@@ -24,7 +24,6 @@
     },
     {
       "id": "user-dirs",
-      "trusted": false,
       "type": "file",
       "path": "${machine:account-home}/.config/user-dirs.dirs",
       "owner": "${machine:account}",