Exempt only the user list's content from the grants step's guard, and test the guard in the send itself (review of #230)

The guard let any field of the list's resource move; its path or mode
changing is a change the step must not carry. The store test now calls
sendToEach, so removing the guard there fails it.

cmd/mesh-controller/release.go

@@ -1048,7 +1048,19 @@ func grantsOnlyIn(ctx context.Context, open *stores, holder string, plan catalog
 	if err := json.Unmarshal(prev, &before); err != nil {
 		return "", fmt.Errorf("what %s was last sent is kept in a form this version does not read: %w", holder, err)
 	}
-	d := diffSent(before, after)
+	other = append(other, otherThanTheList(diffSent(before, after), listID)...)
+	sort.Strings(other)
+	if len(other) == 0 {
+		return "", nil
+	}
+	return "its send would change more than the bus's user list: " + strings.Join(other, "; "), nil
+}
+
+// otherThanTheList is what a diff against the last send changes besides the user list's content: every
+// resource added, removed or changed, but the list's own resource when its content is all that changed —
+// its path, mode and every other field must be as last sent (novox/hq issue 490).
+func otherThanTheList(d sentDiff, listID string) []string {
+	var other []string
 	for _, id := range d.Added {
 		other = append(other, "+"+id)
 	}
@@ -1056,16 +1068,12 @@ func grantsOnlyIn(ctx context.Context, open *stores, holder string, plan catalog
 		other = append(other, "-"+id)
 	}
 	for _, c := range d.Changed {
-		if c.ID == listID {
+		if c.ID == listID && len(c.Fields) == 1 && c.Fields[0] == "content" {
 			continue
 		}
 		other = append(other, fmt.Sprintf("~%s (%s)", c.ID, strings.Join(c.Fields, ", ")))
 	}
-	sort.Strings(other)
-	if len(other) == 0 {
-		return "", nil
-	}
-	return "its send would change more than the bus's user list: " + strings.Join(other, "; "), nil
+	return other
 }
 
 // sendJudged is a gated send's sends: the grants step when the user list changed, then the machine judged.