Exempt only the user list's content from the grants step's guard, and test the guard in the send itself (review of #230)

The guard let any field of the list's resource move; its path or mode
changing is a change the step must not carry. The store test now calls
sendToEach, so removing the guard there fails it.

cmd/mesh-controller/grants_step_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"slices"
@@ -140,6 +141,33 @@ func TestAGrantsStepThatWouldCarryMoreIsNotSent(t *testing.T) {
 	}
 }
 
+// The step's exemption is the list's content alone: its path or mode moving is a change like any other.
+func TestOnlyTheUserListsContentIsExempt(t *testing.T) {
+	list := "nats.bus-users"
+	file := func(fields map[string]any) sentResource {
+		r := map[string]any{"id": list, "type": "file", "path": "/conf/accounts.conf", "mode": "0600", "content": "a"}
+		for k, v := range fields {
+			r[k] = v
+		}
+		body, _ := json.Marshal(map[string]any{"resources": []any{r}})
+		s, err := summarize(body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return s[0]
+	}
+	was := file(nil)
+	if other := otherThanTheList(diffSent([]sentResource{was}, []sentResource{file(map[string]any{"content": "b"})}), list); len(other) != 0 {
+		t.Errorf("the list's new content reads as more: %v", other)
+	}
+	for _, f := range []map[string]any{{"mode": "0644"}, {"path": "/elsewhere"}, {"content": "b", "owner": "nats"}} {
+		other := otherThanTheList(diffSent([]sentResource{was}, []sentResource{file(f)}), list)
+		if len(other) != 1 || !strings.HasPrefix(other[0], "~"+list) {
+			t.Errorf("the list's resource changed by %v reads %v; want it refused", f, other)
+		}
+	}
+}
+
 // The delivery plan says the step before the merge.
 func TestAChangePlanSaysTheGrantsStep(t *testing.T) {
 	const catalogue_ = "http://forge.internal:20000/novox/mesh-catalog.git"