give: never take a trusted party's secret at a desk, and announce it before it is kept (hq ADR 0259 §10, the confirmation review's N1-give)

A desk's prompt is answered over the desk machine's bus, on a subject that machine's runtime answers;
on a desk machine agents run as the operator, who holds that credential, so an agent could answer first
with a bot token of its own sealed to the call's key. The secret of a module running as an account of
its own (the Telegram bot's token) is now refused at the desk, before anybody is asked, naming the line
to type at the controller's terminal; there it is announced on every channel, the old one among them,
before it is kept, and not kept when that announcement fails. What is typed at the terminal is not
echoed. Tests: the refusal with nobody asked, and only the desk machine's launcher may answer its
prompt (MaySubscribe).

internal/broker/nats.go

@@ -216,6 +216,16 @@ func MayPublish(perms Permissions, subject string) bool {
 	return false
 }
 
+// MaySubscribe says whether a principal with these permissions may subscribe to (and so answer) a subject.
+func MaySubscribe(perms Permissions, subject string) bool {
+	for _, a := range perms.Subscribe {
+		if SubjectsOverlap(a, subject) {
+			return true
+		}
+	}
+	return false
+}
+
 // VerbsTheControllerAsksTheDeliveryOwner are the mesh-delivery seat's verbs the controller calls (novox/hq
 // ADR 0239): its self-check reads `stalled`, and healer H2 takes the one transition the table allows
 // through `close`. A mesh seat's verb is flat: no machine in the subject.