Let the module graph decide what a pull request's check runs, in two layers (hq ADR 0237)

Every pull request the forge announces is mapped onto the mesh's module graph by the
merge handler's rule (issue 278): touching a module — or adding one — runs the gate
(mesh/merge-gate), its judge chosen by the graph (the controller judges itself, the
node-engine by its validator); a repository of the mesh that touches none runs only its
own merge-check.sh (mesh/repo-check), a warning when it has none. Nothing is left pending:
a repository outside the mesh touching nothing is told so as a pass.

The gate moves out of the per-repository scripts into the build seat, so a script is the
repository's own tests and declares its toolchain (go or typescript). The controller's
manifest names every verb of its seat again (ADR 0132), held by a test.

cmd/mesh-controller/check_test.go

@@ -92,3 +92,14 @@ func TestRegistrationRefusesADefinitionNamingAnInstallation(t *testing.T) {
 		t.Fatalf("a name declared on purpose passes; got %v", err)
 	}
 }
+
+// **The controller's own manifest names every verb of its seat** (novox/hq ADR 0132): its tools lagged
+// the seat's verbs for weeks, and `module check` — the gate's first step for a change touching it —
+// refused it. Held here, so a verb added to the table without the manifest fails this repository's
+// own suite rather than its next pull request's gate.
+func TestTheControllersManifestServesEveryVerbOfItsSeat(t *testing.T) {
+	var out strings.Builder
+	if err := moduleCheck([]string{"../../module.json"}, &out); err != nil {
+		t.Fatalf("the controller's own module.json fails module check: %v\n%s", err, out.String())
+	}
+}