Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

networking required mesh-wireguard and nothing else; machines are assigned the network directly.
module forget refuses a provided module, so a retired one is removed at start once no machine has it.
Guard route-proxy's public account directory against a reissue.

cmd/mesh-controller/stores.go

@@ -73,6 +73,22 @@ func migrate(ctx context.Context) error {
 		}
 		fmt.Printf("provided %s\n", m.Module)
 	}
+	// And what an earlier release shipped and this one does not goes (novox/hq ADR 0226) — unless a
+	// machine still has it, which is said rather than overridden.
+	var shipped []string
+	for _, m := range provided {
+		shipped = append(shipped, m.Module)
+	}
+	retired, kept, err := inv.RetireUnshipped(ctx, shipped)
+	if err != nil {
+		return err
+	}
+	for _, name := range retired {
+		fmt.Printf("retired %s: the control plane no longer ships it\n", name)
+	}
+	for name, why := range kept {
+		fmt.Printf("kept %s, which the control plane no longer ships: %s\n", name, why)
+	}
 	// The seats the mesh ships with, into the table that now holds the set (novox/hq ADR 0122).
 	// Idempotent: fills an empty table on first boot, adds a seat a release ships, and leaves an
 	// operator's changes in the table as they are.