Judge machines with the node-engine that knows unknown and knows (issue 1024, ADR 0422)

The gate composes every machine with the node-engine's own validator, vendored at mesh-host of 2026-10-15, which refuses the `unknown` and `knows` keys mesh-host #117 added; every catalogue manifest using them was refused on every machine (mesh-catalog #349). The pin moves to #117's merge, 6469e8238443, delivered; only the declaration validator changes in vendor/. A test holds the gate to taking such a directory.

cmd/mesh-controller/owned_paths_test.go

@@ -0,0 +1,23 @@
+package main
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/novox/mesh-host/validate"
+)
+
+// A directory or an archive that says how it reacts to files it does not know (novox/hq ADR 0422) is a
+// declaration the node-engine takes, so the gate, which judges every machine with the node-engine's own
+// validator, takes it too. Before the pin moved, every catalogue manifest using the words was refused
+// on every machine (issue 1024).
+func TestTheGateTakesADirectoryThatSaysHowItReacts(t *testing.T) {
+	decl := fmt.Sprintf(`{"declaration":%d,"resources":[
+ {"id":"xorg.config","type":"directory","path":"/home/a/.config/xorg","mode":"0755","owner":"a","unknown":"move-out","knows":["scripts/"]},
+ {"id":"p10k.theme","type":"archive","source":"https://example.invalid/a.tar","digest":"sha256:`+
+		"0000000000000000000000000000000000000000000000000000000000000000"+
+		`","path":"/home/a/.local/share/powerlevel10k","unknown":"move-out"}]}`, validate.Version)
+	if problems := validate.Declaration([]byte(decl)); len(problems) != 0 {
+		t.Fatalf("refused: %q", problems)
+	}
+}