Step back from a rendered resolver file only, and compare a declared path cleaned (issue 412, review 80)

A resource on the resolver file was left out by the check and still composed by the declaration, so an
uplink declaring it as a resource beside the resolver passed with two writers; it is refused again, as
before. And /etc//hosts or /etc/../etc/hosts is /etc/hosts to the machine, so it is compared cleaned.
A seat names no root or top-level directory.

internal/catalogue/seat_paths.go

@@ -45,6 +45,10 @@ func seatPathProblem(seat, scope, p string) string {
 	case !strings.HasPrefix(p, "/") || path.Clean(p) != p:
 		return fmt.Sprintf("the seat %s names the path %q, which is not a clean absolute path (novox/hq ADR 0287)",
 			seat, p)
+	case path.Dir(p) == "/":
+		// The root or a top-level directory is every role's, never one role's own (ADR 0287).
+		return fmt.Sprintf("the seat %s names the path %q, the root or a top-level directory, which no one "+
+			"role owns (novox/hq ADR 0287)", seat, p)
 	}
 	return ""
 }
@@ -113,16 +117,20 @@ func namesWithoutSteppingBack(s Seat, p string) bool {
 
 // declaredPaths is every machine path a module declares it owns: a resource's literal path, and a file
 // the mesh renders for it outside the operator's home. An access is not here — reading is not owning.
+//
+// **Cleaned, because the machine writes the cleaned path**: /etc//hosts, /etc/./hosts, /etc/../etc/hosts and
+// /etc/hosts/ are all /etc/hosts to it, and a seat's path is clean by its own rule, so a declaration compared
+// as written would pass for a path nobody named.
 func declaredPaths(m Manifest) map[string]bool {
 	out := map[string]bool{}
 	for _, r := range m.Resources {
 		if p, ok := r["path"].(string); ok && strings.HasPrefix(p, "/") {
-			out[p] = true
+			out[path.Clean(p)] = true
 		}
 	}
 	for _, f := range m.Facts {
 		if !f.Home && strings.HasPrefix(f.Path, "/") {
-			out[f.Path] = true
+			out[path.Clean(f.Path)] = true
 		}
 	}
 	return out