Rename the mesh's seats to mesh-*, keeping their interfaces

novox/hq ADR 0118: the prefix is the reservation rule, so a module
declaring any mesh-* name is refused and there is no reserved-names list to
drift. Ten seats renamed in the table, the manifests that claim them, the
controller's own shipped manifests, and the tests.

Not the migration 0118 expected: a holding is derived at resolution from
manifests and never stored, so nothing recorded points at an old name. A
kept rename table tells a manifest written against one what it became —
kept rather than retired, because a module lives in its own repository and
may be registered long after the catalogue stopped using it.

**A seat is not the interface it delivers.** The git seat became mesh-git
and the git provision did not; likewise the package registry. A blanket
replace renamed both, and the failure read "the package registry is served
on <nil>", which does not say "you renamed an interface". A test now pins
every seat against what it delivers, and that neither name is also the
other.

cmd/mesh-controller/seats_test.go

@@ -35,13 +35,13 @@ func TestEverySeatIsListedIncludingTheOnesNobodyHolds(t *testing.T) {
 
 func TestANodeSeatListsEveryMachineHoldingIt(t *testing.T) {
 	rows, _ := seatsHeld(catalogue.Seats(), []catalogue.Held{
-		{Claim: "the-packet-filter", Scope: catalogue.ScopeNode, Node: "node2", Module: "nftables"},
-		{Claim: "the-packet-filter", Scope: catalogue.ScopeNode, Node: "anchor", Module: "nftables"},
+		{Claim: "mesh-packet-filter", Scope: catalogue.ScopeNode, Node: "node2", Module: "nftables"},
+		{Claim: "mesh-packet-filter", Scope: catalogue.ScopeNode, Node: "anchor", Module: "nftables"},
 		// Resolved twice, reported once: a machine is one holder however many passes saw it.
-		{Claim: "the-packet-filter", Scope: catalogue.ScopeNode, Node: "anchor", Module: "nftables"},
+		{Claim: "mesh-packet-filter", Scope: catalogue.ScopeNode, Node: "anchor", Module: "nftables"},
 	})
 	for _, r := range rows {
-		if r.Seat != "the-packet-filter" {
+		if r.Seat != "mesh-packet-filter" {
 			continue
 		}
 		if len(r.Holders) != 2 || r.Holders[0].Node != "anchor" || r.Holders[1].Node != "node2" {

cmd/mesh-controller/source.go

@@ -18,7 +18,7 @@ import (
 // seat's holder runs.
 
 // gitSeat is the seat a self-hosted repository lives on.
-const gitSeat = "git"
+const gitSeat = "mesh-git"
 
 // buildSource is where a build's repository is: a URL, or a path on a seat's holder.
 type buildSource struct {

cmd/mesh-controller/source_test.go

@@ -11,7 +11,7 @@ import (
 
 func forgeHolding(port any) catalogue.World {
 	return catalogue.World{
-		Held: []catalogue.Held{{Claim: "git", Scope: catalogue.ScopeMesh, Node: "anchor", Module: "gitea"}},
+		Held: []catalogue.Held{{Claim: "mesh-git", Scope: catalogue.ScopeMesh, Node: "anchor", Module: "gitea"}},
 		Offered: map[string][]catalogue.Provider{"git": {
 			// A second forge that does not hold the seat, so taking the first one found would be wrong.
 			{Node: "archive", At: "archive.internal", Module: "gitea-mirror",
@@ -23,7 +23,7 @@ func forgeHolding(port any) catalogue.World {
 }
 
 func TestARepositoryOnTheSeatIsClonedFromItsHolder(t *testing.T) {
-	got, err := clonedFromSeat(forgeHolding(float64(3000)), "git", "novox/mesh-catalog")
+	got, err := clonedFromSeat(forgeHolding(float64(3000)), "mesh-git", "novox/mesh-catalog")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -35,7 +35,7 @@ func TestARepositoryOnTheSeatIsClonedFromItsHolder(t *testing.T) {
 func TestAMovedForgeIsFollowedWithoutRewritingAnything(t *testing.T) {
 	// The whole point: the node gave the forge another port, and the same recorded path clones
 	// from the new one. Nothing recorded contained the old one to be wrong.
-	got, err := clonedFromSeat(forgeHolding(float64(3100)), "git", "novox/mesh-catalog")
+	got, err := clonedFromSeat(forgeHolding(float64(3100)), "mesh-git", "novox/mesh-catalog")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -45,11 +45,11 @@ func TestAMovedForgeIsFollowedWithoutRewritingAnything(t *testing.T) {
 }
 
 func TestWithNobodyHoldingTheSeatASelfHostedBuildIsRefusedAndSaysWhy(t *testing.T) {
-	_, err := clonedFromSeat(catalogue.World{}, "git", "novox/mesh-catalog")
+	_, err := clonedFromSeat(catalogue.World{}, "mesh-git", "novox/mesh-catalog")
 	if err == nil {
 		t.Fatal("a repository was cloned from a forge the mesh does not have")
 	}
-	for _, want := range []string{"nobody holds the git seat", "without --self"} {
+	for _, want := range []string{"nobody holds the mesh-git seat", "without --self"} {
 		if !strings.Contains(err.Error(), want) {
 			t.Fatalf("the refusal does not say %q: %v", want, err)
 		}
@@ -71,7 +71,7 @@ func TestAnExternalRepositoryIsClonedExactlyAsGiven(t *testing.T) {
 func TestAHolderOffThePrivateNetworkIsRefused(t *testing.T) {
 	world := forgeHolding(float64(3000))
 	world.Offered["git"][1].At = ""
-	if _, err := clonedFromSeat(world, "git", "novox/mesh-catalog"); err == nil ||
+	if _, err := clonedFromSeat(world, "mesh-git", "novox/mesh-catalog"); err == nil ||
 		!strings.Contains(err.Error(), "private network") {
 		t.Fatalf("a forge nothing can reach was cloned from: %v", err)
 	}
@@ -79,7 +79,7 @@ func TestAHolderOffThePrivateNetworkIsRefused(t *testing.T) {
 
 func TestAHolderServingNoPortIsRefusedRatherThanGuessed(t *testing.T) {
 	// A default port would be the forge's address guessed, which is what this exists to stop.
-	if _, err := clonedFromSeat(forgeHolding(nil), "git", "novox/mesh-catalog"); err == nil {
+	if _, err := clonedFromSeat(forgeHolding(nil), "mesh-git", "novox/mesh-catalog"); err == nil {
 		t.Fatal("a port was guessed for a forge that serves none")
 	}
 }
@@ -101,8 +101,8 @@ func TestAnAddressGivenAsAPathOnTheForgeIsRefused(t *testing.T) {
 }
 
 func TestASourceOnTheSeatReadsAsAPathNotAnAddress(t *testing.T) {
-	s := buildSource{Repository: "novox/mesh-catalog", Seat: "git"}
-	if got := s.String(); got != "novox/mesh-catalog on the git seat" {
+	s := buildSource{Repository: "novox/mesh-catalog", Seat: "mesh-git"}
+	if got := s.String(); got != "novox/mesh-catalog on the mesh-git seat" {
 		t.Fatalf("read as %q", got)
 	}
 }