mesh-knowledge: review every proposal in a judgement of its own, and serve no review verb (hq issue 425, ADR 0290 as updated)

The mesh proves which machine called, not which agent on it (hq issue 365), so a review verb could not tell a
reviewer from the author. Each version proposed is now judged by claude-code.claude_code_judge in a separate
call that sees only the record, the records it links and the rules: approve accepts (or asks the operator for a
needs-operator record), changes keeps it proposed with the findings for its author, and a judgement that cannot
be had or read leaves it proposed, says so, and never counts as approval.

modules/mesh-knowledge/cmd/mesh-knowledge/bus_test.go

@@ -351,9 +351,13 @@ func TestTheKnowledgeBaseOverTheBus(t *testing.T) {
 	if prop.Status != StatusProposed {
 		t.Fatalf("%+v", prop)
 	}
-	// The runtime proves no caller yet: the review is refused, and says why.
-	if _, err := b.call(Seat+".review", map[string]any{"number": 300, "verdict": "approve"}); err == nil || !strings.Contains(err.Error(), "issue 365") {
-		t.Fatalf("a review by an unproven caller over the bus: %v", err)
+	// No one reviews a record: the review is the knowledge base's own, and the verb is gone.
+	if _, err := b.call(Seat+".review", map[string]any{"number": 300, "verdict": "approve"}); err == nil {
+		t.Fatal("a review verb is served")
+	}
+	// This proposal's caller is unproven over this runtime: it is never reviewed, and says why.
+	if !strings.Contains(prop.Says, "proved no caller") {
+		t.Fatalf("propose says %q", prop.Says)
 	}
 	// What holds, in one call within its bound.
 	raw := must(b.call(Seat+".ask", map[string]any{"question": "what holds about the merge window, and why"}))