Take core-credentials out of the bus's, the provisioner's and its client's manifests until the judge that knows it runs

The running indexer's judge refuses the word, a refused manifest holds the bus's user list, and so the indexer build
that knows the word is never granted. The node-engine on main still finds these modules by its name list, and the
vault keeps no list, so no credential is lost; the word comes back once the new judge runs (issue 774).

Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn

modules/nats/module.json

@@ -21,7 +21,6 @@
     }
   ],
   "bus-users": "/var/lib/nats-module/conf/accounts.conf",
-  "core-credentials": true,
   "own-secrets": {
     "broker": "${dir:mesh-state}/broker",
     "broker-nats-tools": "${dir:tools-secret}/broker-nats-tools"