zsh: let a machine withhold node-login-shell's execute

execute runs any command as the operator account, which can become root
without a person. The operator withholds it on the control-node until a
call needs a person's approval (hq ADR 0268); the other machines keep it
for now. The setting execute (serve by default) is written into a
root-owned file the tools bundle reads at start, and anything but serve
withholds the verb, so the machine's runtime does not offer it.

modules/zsh/README.md

@@ -8,8 +8,16 @@ The login shell as a module (novox/hq ADR 0176, ADR 0204, to-be 41).
   account in a zsh login shell in the account's home. It is ended with everything it started after
   20 s by default (25 s at most, below the runtime's 30 s call limit). Each stream is cut at 256 KiB
   and the answer says so in `truncated`.
+- **A machine may withhold `execute`** (hq ADR 0268). It runs any command as the operator account,
+  which can become root without a person. The setting `execute` is `serve` by default; a machine's
+  layer `withhold` (`mesh-controller.settings` with `module` zsh, `node` the machine, `values`
+  `{"execute":"withhold"}`, then a push) makes the runtime there offer no `execute` at all. The mesh
+  writes the value into a root-owned `tools.conf` in the module's directory, which the tools bundle
+  reads when the runtime starts it; a change restarts the runtime. Anything but `serve` (a wrong value,
+  no file) withholds it, and says why on stderr and in `zsh_config`'s `execute`. The control-node
+  withholds it until a call to it needs a person's approval (hq research 039).
 - Its own tool `zsh_config` shows `~/.zshenv` and `~/.zshrc` as they are, with the mesh block's line
-  count in each.
+  count in each, and whether this machine serves `execute`, and why.
 - Contributes to the account's environment (ADR 0203): `EDITOR` and `VISUAL` (vim), `XDG_CONFIG_HOME`,
   and `~/.local/bin`, `~/scripts`, `~/scripts/bin` at the start of `PATH`. The holder of
   `node-environment` (`node-env`) writes them; this module writes no `export` of its own.