A setting reaches only what declares it, the mesh places its own files, registration refuses a name

Three of novox/hq's group-4 leftovers, one branch.

Issue 173: a module's settings reached every route it contributed, every database it asked for and
every served fact its consumers read — a mail server's site name arrived at the proxy as a route
fact. A setting now overrides a key a contribution or served fact declares and adds none; a file
still merges any key, and a key nothing takes is named as stray instead of dropped silently.

Issue 174: the mesh's own files for a module — its bus credential, its merged config, its bindings —
were placed by the definition under /var/lib/mesh/<module>, 232 host paths in 50 definitions. A
directory may now say `place: "mesh"` and resolves to <root>/mesh/<module>; a directory beneath a
placed one may state its path as `${dir:<id>}/<rest>` and moves with it. The proof test resolves
both catalogues and compares: 48 definitions, no path moved. The controller's own manifest is
converted here; the catalogue in mesh-catalog.

ADR 0155: the installation check moves to registration. `module add` and a build's result both
refuse a definition that names an installation, in the check's words, with the way out; the build
stays recorded.

module.json

@@ -18,13 +18,13 @@
     }
   ],
   "own-secrets": {
-    "inventory": "/var/lib/mesh/mesh-controller/inventory",
-    "identity": "/var/lib/mesh/mesh-controller/identity",
-    "licences": "/var/lib/mesh/mesh-controller/licences",
-    "broker": "/var/lib/mesh/mesh-controller/broker",
-    "broker-management": "/var/lib/mesh/mesh-controller/broker-management",
-    "broker-address": "/var/lib/mesh/mesh-controller/broker-address",
-    "bus": "/var/lib/mesh/mesh-controller/bus"
+    "inventory": "${dir:mesh-state}/inventory",
+    "identity": "${dir:mesh-state}/identity",
+    "licences": "${dir:mesh-state}/licences",
+    "broker": "${dir:mesh-state}/broker",
+    "broker-management": "${dir:mesh-state}/broker-management",
+    "broker-address": "${dir:mesh-state}/broker-address",
+    "bus": "${dir:mesh-state}/bus"
   },
   "secrets-owner": "65534:65534",
   "prepares": true,
@@ -46,8 +46,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/mesh-controller",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "server",
@@ -73,13 +73,13 @@
       },
       "volumes": [
         "/var/lib/mesh-broker-tls:/broker-tls:ro",
-        "/var/lib/mesh/mesh-controller/inventory:/run/secrets/inventory:ro",
-        "/var/lib/mesh/mesh-controller/identity:/run/secrets/identity:ro",
-        "/var/lib/mesh/mesh-controller/licences:/run/secrets/licences:ro",
-        "/var/lib/mesh/mesh-controller/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/mesh-controller/bus:/run/secrets/bus:ro",
-        "/var/lib/mesh/mesh-controller/broker-management:/run/secrets/broker-management:ro",
-        "/var/lib/mesh/mesh-controller/broker-address:/run/secrets/broker-address:ro"
+        "${dir:mesh-state}/inventory:/run/secrets/inventory:ro",
+        "${dir:mesh-state}/identity:/run/secrets/identity:ro",
+        "${dir:mesh-state}/licences:/run/secrets/licences:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/bus:/run/secrets/bus:ro",
+        "${dir:mesh-state}/broker-management:/run/secrets/broker-management:ro",
+        "${dir:mesh-state}/broker-address:/run/secrets/broker-address:ro"
       ],
       "artifact": "server",
       "restart-on": [