Credentials the mesh delivers and cannot read

HAL keeps env vars in the registry, encrypted at rest. Its own tooling
records what that bought and what it did not. `secret_locate` matches by
value rather than by name — because the same password sits in
mesh_provisions, in module_env, in each node's .env in plain text, and
inside every connection string composed from it, and its documentation
says those URL copies "are often the only copies actually in use". And a
query against the encrypted column returns zero rows and proves nothing,
so auditing moved to the decrypted copies on the nodes.

Two faults there, and encryption at rest addresses neither: the control
plane can read what it stores, so a copy of the database is a copy of
every credential; and one secret has many homes with nothing tracking
them.

So here the mesh generates a password, seals it to each end with keys
those nodes generated, stores both blobs, and discards the plaintext. It
cannot read what it holds. Neither can the broker relaying it. And
nothing is composed centrally — a connection string is assembled on the
machine that needs one — so no copy is ever minted in a shape nothing
tracks. `Compromise of a node is compromise of that node` (ADR 0004) is
now true of secrets, not only of identity.

Two files rather than one, because the mesh cannot compose a document
containing a value it discarded: `binds` carries the readable facts,
`secrets` carries the credential alone. The readable half stays readable
in the declaration; the secret half changes only when the secret does,
which makes restart-on precise. The provider gets a directory, one file
per consumer, for the same reason.

It is made once and kept — regenerating per declaration would restart
both ends on every push, and the password a provider was told to create
would never be the one its consumer was given. It is remade when either
end's sealing key changes, and both ends learn the new one in the same
push, so there is no window where half the mesh holds a dead credential.

Two tests found passing for the wrong reason, both caught because their
injection came back clean:

- the provider's copy was asserted non-empty, which reads the same
  whichever column is selected. It now opens the blob with the
  provider's own key.
- RotateSecret deleted and re-created; the re-create was dead, because
  the next read makes one anyway. Removed, and a second path to the same
  act is how two ends come to disagree.

And one real fault: three places built a declaration, and the one behind
`--json` predated credentials, so it silently produced a declaration
missing them — a difference between what `plan` showed and what anything
reading `--json` got. There is one path now.

internal/catalogue/resolve.go

@@ -98,6 +98,9 @@ type Needed struct {
 	At string
 	// Serves is what the providing module said a consumer needs to know.
 	Serves map[string]any
+	// Sealed is the credential, closed to this node. Filled in after resolving, because whose
+	// credential it is only becomes answerable once which node answers has been settled.
+	Sealed string
 	// For is the module that wanted it.
 	For string
 }
@@ -453,10 +456,24 @@ type Generator interface {
 	Resources(node string) ([]map[string]any, bool, error)
 }
 
+// Grant is one consumer's credential, on the machine that must create it.
+type Grant struct {
+	// Provision is what was required.
+	Provision string
+	// Consumer is the node that will use it, which is also what names the file.
+	Consumer string
+	// Sealed is the credential, closed to the providing node.
+	Sealed string
+}
+
 // Rendering is everything needed to turn a resolution into the declaration a node is sent.
 type Rendering struct {
 	Settings   SettingsBy
 	Generators map[string]Generator
+	// Grants are the credentials this node must create, for the provisions it offers. Passed in
+	// rather than resolved, because who consumes a node is a fact about the rest of the mesh and
+	// resolution answers questions about one machine.
+	Grants []Grant
 }
 
 // Declaration is everything the resolved modules put on the node, with settings applied.
@@ -473,6 +490,37 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 	var out []map[string]any
 	for _, m := range r.Modules {
 		resources := m.Resources
+		for _, to := range sortedKeys(m.Secrets) {
+			var found *Needed
+			for i, n := range r.Needs {
+				if n.Name == to {
+					found = &r.Needs[i]
+				}
+			}
+			if found == nil || found.Sealed == "" {
+				// Answered on this machine, or answered by a node the mesh could not seal to.
+				// Nothing to write either way, and writing an empty credential file would be
+				// worse than none: something would read it and fail authenticating.
+				continue
+			}
+			resources = append(append([]map[string]any{}, resources...), map[string]any{
+				"id": SecretID(to), "type": "file", "path": m.Secrets[to],
+				"sealed": found.Sealed,
+			})
+		}
+		for _, to := range sortedKeys(m.Grants) {
+			for _, g := range with.Grants {
+				if g.Provision != to {
+					continue
+				}
+				resources = append(append([]map[string]any{}, resources...), map[string]any{
+					"id":     GrantID(to, g.Consumer),
+					"type":   "file",
+					"path":   strings.TrimRight(m.Grants[to], "/") + "/" + g.Consumer,
+					"sealed": g.Sealed,
+				})
+			}
+		}
 		for _, to := range sortedKeys(m.Binds) {
 			var found *Needed
 			for i, n := range r.Needs {