Rename the mesh's seats to mesh-*, keeping their interfaces

novox/hq ADR 0118: the prefix is the reservation rule, so a module
declaring any mesh-* name is refused and there is no reserved-names list to
drift. Ten seats renamed in the table, the manifests that claim them, the
controller's own shipped manifests, and the tests.

Not the migration 0118 expected: a holding is derived at resolution from
manifests and never stored, so nothing recorded points at an old name. A
kept rename table tells a manifest written against one what it became —
kept rather than retired, because a module lives in its own repository and
may be registered long after the catalogue stopped using it.

**A seat is not the interface it delivers.** The git seat became mesh-git
and the git provision did not; likewise the package registry. A blanket
replace renamed both, and the failure read "the package registry is served
on <nil>", which does not say "you renamed an interface". A test now pins
every seat against what it delivers, and that neither name is also the
other.

internal/catalogue/seats.go

@@ -49,17 +49,17 @@ var seats = []Seat{
 	// `mesh-bus` is the mesh's own; `nats` is a private NATS server a module may provide as a
 	// backing service, the way `amqp` is provided (ADR 0119). Never the same name.
 	{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "mesh-bus", Decision: "novox/hq ADR 0079"},
-	{Name: "the-artifact-store", Scope: ScopeMesh, Delivers: "artifact-store", Decision: "novox/hq ADR 0075"},
-	{Name: "the-catalogue", Scope: ScopeMesh, Decision: "novox/hq ADR 0110"},
-	{Name: "npm-package-registry", Scope: ScopeMesh, Delivers: "npm-package-registry", Decision: "novox/hq ADR 0109"},
-	{Name: "git", Scope: ScopeMesh, Delivers: "git", Decision: "novox/hq ADR 0111"},
-	{Name: "the-build-machine", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
-	{Name: "the-dns-port", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
-	{Name: "the-intrusion-prevention", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
-	{Name: "the-packet-filter", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
-	{Name: "the-private-network", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
-	{Name: "the-resolver-configuration", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
-	{Name: "the-showcase", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
+	{Name: "mesh-artifact-store", Scope: ScopeMesh, Delivers: "artifact-store", Decision: "novox/hq ADR 0075"},
+	{Name: "mesh-catalog", Scope: ScopeMesh, Decision: "novox/hq ADR 0110"},
+	{Name: "mesh-npm-package-registry", Scope: ScopeMesh, Delivers: "npm-package-registry", Decision: "novox/hq ADR 0109"},
+	{Name: "mesh-git", Scope: ScopeMesh, Delivers: "git", Decision: "novox/hq ADR 0111"},
+	{Name: "mesh-build-machine", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
+	{Name: "mesh-dns-port", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
+	{Name: "mesh-intrusion-prevention", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
+	{Name: "mesh-packet-filter", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
+	{Name: "mesh-private-network", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
+	{Name: "mesh-resolver-configuration", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
+	{Name: "mesh-showcase", Scope: ScopeNode, Decision: "novox/hq ADR 0110"},
 }
 
 // Seats is every seat the mesh defines, in reading order.
@@ -98,6 +98,16 @@ func SeatDelivering(provision string) (Seat, bool) {
 func claimProblems(m Manifest) []string {
 	var problems []string
 	for _, c := range m.Claims {
+		if now, was := renamedSeats[c.Name]; was {
+			// Named rather than refused as unknown: whoever wrote it knew what they meant, and
+			// the mesh knows what it is called now — the same courtesy the `needs`/`own-secrets`
+			// rename gets. Without this the refusal would be "not a seat", which sends somebody
+			// reading code for a name that is one character different.
+			problems = append(problems, fmt.Sprintf(
+				"%s claims %q, which is now called %q (novox/hq ADR 0118: the mesh's own seats "+
+					"are named mesh-*, and the prefix is what reserves them)", m.Module, c.Name, now))
+			continue
+		}
 		seat, known := SeatNamed(c.Name)
 		if !known {
 			// Not one of the mesh's own, which no longer means it is not a seat: a module may
@@ -162,3 +172,28 @@ func HolderAmong(provision string, providers []Provider, held []Held) (Provider,
 	}
 	return Provider{}, false
 }
+
+// renamedSeats is what the mesh's own seats used to be called (novox/hq ADR 0118).
+//
+// **A rename here is not a data migration**, which ADR 0118 assumed it was and a progressive
+// insight there corrects: a seat's holding is *derived* at resolution from the claims in
+// manifests (`resolve.go`), never stored, so there are no recorded old names to rewrite. What
+// exists is source — manifests in the catalogue — and this list is how one written against the
+// old name is told what it became rather than refused as unknown.
+//
+// It is kept, not retired after the catalogue is updated: a module lives in its own repository
+// ([ADR 0069]) and may be registered from anywhere, so an old name can arrive long after the
+// catalogue beside this checkout stopped using one.
+var renamedSeats = map[string]string{
+	"the-artifact-store":         "mesh-artifact-store",
+	"the-catalogue":              "mesh-catalog",
+	"npm-package-registry":       "mesh-npm-package-registry",
+	"git":                        "mesh-git",
+	"the-build-machine":          "mesh-build-machine",
+	"the-dns-port":               "mesh-dns-port",
+	"the-intrusion-prevention":   "mesh-intrusion-prevention",
+	"the-packet-filter":          "mesh-packet-filter",
+	"the-private-network":        "mesh-private-network",
+	"the-resolver-configuration": "mesh-resolver-configuration",
+	"the-showcase":               "mesh-showcase",
+}