A3k finding 2: distribution reads its caller list as mesh-config resolves it, not from an environment nothing renders

The node-engine fills ${config:} only in files, unit names, owners and groups, never in a
process's environment, so MESH_CONFIG_CALLERS was never set and design 51's defaults always held.
The tools bundle now reads `callers` through stdio.Config on each call (holder.ConfiguredCallers,
Verbs.WithCallers per call); the program, which has no runtime resolving config, asks its own
tools bundle's new registry_callers on each wake of the windows (manifest invokes). The
environment variable is gone.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/internal/holder/callers.go

@@ -89,6 +89,37 @@ func ParseCallers(raw string) (Callers, error) {
 	if err != nil {
 		return nil, err
 	}
+	return selfNotReleasing(c)
+}
+
+// ConfiguredCallers is the config value `callers` as mesh-config resolved it for this machine, read through the tools
+// runtime's stdio.Config on each call (never an environment variable: nothing renders a config value into a
+// program's environment); unset is DefaultCallers, and Self on release's list is refused as ParseCallers refuses it.
+func ConfiguredCallers() (Callers, error) {
+	c, err := stdio.ConfiguredVerbCallers(CallersConfig, VerbsOf(ImageSeat), DefaultCallers())
+	if err != nil {
+		return nil, err
+	}
+	return selfNotReleasing(c)
+}
+
+// CallersConfig is the config value's key, and CallersTool the tools bundle's tool answering it as resolved: the
+// program, which has no tools runtime, asks that tool over the bus (manifest invokes).
+const (
+	CallersConfig = "callers"
+	CallersTool   = "registry_callers"
+)
+
+// WithCallers is v with the caller list c: a copy for one call, so a list read on that call never changes another's.
+func (v *Verbs) WithCallers(c Callers) *Verbs {
+	h := *v.Holder
+	h.Callers = c
+	out := *v
+	out.Holder = &h
+	return &out
+}
+
+func selfNotReleasing(c Callers) (Callers, error) {
 	if slices.Contains(c[VerbRelease], Self) {
 		return nil, fmt.Errorf("callers puts %s on release's list: registry_holds would release in its own name", Self)
 	}

modules/distribution/internal/holder/driver.go

@@ -63,7 +63,8 @@ type WindowState interface {
 type Driver struct {
 	Delivery Delivery
 	State    WindowState
-	Callers  Callers
+	// Callers is the caller list as it holds on this wake: publish's callers are the build modules counted.
+	Callers func() (Callers, error)
 	// Closed says a window's closing on distribution.events.
 	Closed  func(c Closed) error
 	Finding func(kind, subject, words string, raised bool)
@@ -84,7 +85,11 @@ func (d *Driver) Read() ([]NodeRead, error) {
 	if err != nil {
 		return nil, fmt.Errorf("the publishing builds cannot be read, so no window moves: %w", err)
 	}
-	builds := d.Callers[VerbPublish]
+	callers, err := d.Callers()
+	if err != nil {
+		return nil, fmt.Errorf("the caller list cannot be read, so no window moves: %w", err)
+	}
+	builds := callers[VerbPublish]
 	byNode := map[string]*NodeRead{}
 	var order []string
 	for _, h := range haves {

modules/distribution/internal/holder/holder_test.go

@@ -532,7 +532,7 @@ func TestTheHolderOfTheTwoImageSeats(t *testing.T) {
 		var closed []string
 		found := map[string]bool{}
 		now := time.Unix(0, 0)
-		d := &Driver{Delivery: del, State: st, Callers: DefaultCallers(), Now: func() time.Time { return now },
+		d := &Driver{Delivery: del, State: st, Callers: func() (Callers, error) { return DefaultCallers(), nil }, Now: func() time.Time { return now },
 			Closed:  func(c Closed) error { closed = append(closed, c.Window+" "+c.Seat); return nil },
 			Finding: func(kind, subject, _ string, raised bool) { found[kind+" "+subject] = raised }}
 		if _, err := d.Wake("start"); err != nil {