zsh: let a machine withhold node-login-shell's execute

execute runs any command as the operator account, which can become root
without a person. The operator withholds it on the control-node until a
call needs a person's approval (hq ADR 0268); the other machines keep it
for now. The setting execute (serve by default) is written into a
root-owned file the tools bundle reads at start, and anything but serve
withholds the verb, so the machine's runtime does not offer it.

modules/zsh/module.json

@@ -16,6 +16,13 @@
   "tools": [
     "zsh_config"
   ],
+  "settings": {
+    "execute": {
+      "kind": "preference",
+      "default": "serve",
+      "why": "execute runs any command as the operator account, which can become root without a person; a machine whose layer says withhold does not offer it (hq ADR 0268): the control-node, until a call to it needs a person's approval"
+    }
+  },
   "environment": {
     "variables": {
       "EDITOR": "vim",
@@ -68,6 +75,21 @@
       "type": "user",
       "name": "${machine:account}",
       "shell": "/usr/bin/zsh"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "place": ".",
+      "owner": "root",
+      "mode": "0755"
+    },
+    {
+      "id": "tools-conf",
+      "type": "file",
+      "path": "${dir:state}/tools.conf",
+      "owner": "root",
+      "mode": "0644",
+      "content": "# Written by the mesh (module zsh, hq ADR 0268) from this machine's setting execute: serve or withhold.\n# Read by the zsh tools bundle when the runtime starts it; change the setting, not this.\nexecute=${setting:execute}\n"
     }
   ],
   "build": {
@@ -78,7 +100,10 @@
         "language": "typescript",
         "entrypoints": [
           "tools/index.js"
-        ]
+        ],
+        "env": {
+          "ZSH_TOOLS_CONF": "${dir:state}/tools.conf"
+        }
       }
     ]
   }