checks/controllerdeps decodes every module.json and judges the set with mesh-sdk's ManifestRefusals at the phase of the
lease write's own delivery, so no module reads, invokes or consumes the controller beyond the lease and the entries
kept to the write. At origin/main it refuses 11 declarations (the ones S7-S12 drop); at this head it passes. Two
tests (the real tree, and four rows on a tree of its own), in a new check of its own; go.mod pins the previous
mesh-sdk until the group's head is pinned, and go.sum needs the group's entries then.
(issue 774, 774/S13)
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
jschoubben
2877b87f29