Take core-credentials out of the bus's, the provisioner's and its client's manifests until the judge that knows it runs

The running indexer's judge refuses the word, a refused manifest holds the bus's user list, and so the indexer build
that knows the word is never granted. The node-engine on main still finds these modules by its name list, and the
vault keeps no list, so no credential is lost; the word comes back once the new judge runs (issue 774).

Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn

modules/nats/cmd/nats-tools/manifest_test.go

@@ -43,6 +43,11 @@ func TestTheBussManifestMountsItsProgramsIntoTheUpstreamImage(t *testing.T) {
 	if err := json.Unmarshal(raw, &m); err != nil {
 		t.Fatal(err)
 	}
+	// No "core-credentials" until the indexer whose judge knows the word runs (issue 774): the running judge refuses it,
+	// and a refused manifest holds the bus's user list, so the indexer that knows it is never granted. It comes back then.
+	if strings.Contains(string(raw), `"core-credentials"`) {
+		t.Error("the manifest says \"core-credentials\" before the judge that reads it runs")
+	}
 	if m.Build.On != nil {
 		t.Error("build.on is declared: nothing is built on a base image any more")
 	}