A secret given tells the operator once, opens no condition (issue 835)

ADR 0380: giving a module's own secret now asks the operator channel's
tell over the bus, naming the secret, where, when and who asked, and
raises no secret-given condition. Until nothing serves tell yet, or the
controller's grant is refused (link.ErrNothingServes / the new
link.ErrGrantRefused), the condition is raised exactly as before, so the
change composes whichever side of issue 797 merges first. A successful
tell also retires every open secret-given condition. The terminal's own
secret accept now records a hand act too, as the desk path already did.

The controller's bus grant for operator-channel.tell is added to the
composed config (golden fixture updated).

internal/link/queue.go

@@ -641,8 +641,8 @@ func AskMeshSeatTool(ctx context.Context, conn *nats.Conn, seat, verb string, ar
 		reply, err = r.msg, r.err
 	case why := <-refused:
 		cancel()
-		return Answer{}, fmt.Errorf("the bus refused the controller asking %s.%s — its grants do not name %s: %v",
-			seat, verb, subject, why)
+		return Answer{}, fmt.Errorf("%w: the bus refused the controller asking %s.%s — its grants do not name %s: %v",
+			ErrGrantRefused, seat, verb, subject, why)
 	}
 	switch {
 	case errors.Is(err, nats.ErrNoResponders):

internal/link/retirement.go

@@ -167,6 +167,11 @@ const (
 // is older than the tool.
 var ErrNothingServes = errors.New("nothing serves it")
 
+// ErrGrantRefused is the bus refusing this principal's own call: its grants do not name the subject
+// asked. Distinct from ErrNothingServes (nobody there to answer) — this is the asker's own grant, not
+// the holder's absence (novox/hq ADR 0380 §9).
+var ErrGrantRefused = errors.New("the bus refused the ask")
+
 // ModuleToolOn is where one machine's instance of a module answers a tool: the module's tool subject
 // with the machine as its last token — the subject the node tools bind beside the shared one.
 func ModuleToolOn(module, tool, node string) string { return ToolSubject(module, tool) + "." + node }