No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

Two incidents had one shape: a change took effect that nobody saw first (hq issues 241, 304).
Three guards, each silent when nothing is at stake:

- settings show [--history], and a set that answers each key it adds, changes and removes, and
  refuses a removal unless --replace; the replaced or cleared layer is kept in settings_history,
  in the same transaction as the write (migration 0078).
- every send keeps a summary of what it sent (no file content), plan <node> --diff compares with
  it, and push with no machine is refused unless --all.
- a push that would give a running container's mount another host directory holds that machine,
  naming the module, mount and both directories, until push <node> --move <module>; a named push's
  cascade is held the same way.

Rebased onto main and fitted to it: the hold runs before the push says what it recreates, a whole
push still says so first and leaves machines waiting for a gate, the verb's push with no machine is
still --behind and a push still needs why. The verbs take plan diff, settings replace and history,
and push move beside a machine, each refused where it cannot take effect.

cmd/mesh-controller/seatverbs_test.go

@@ -72,9 +72,11 @@ func TestSettingsSetsOrClearsALayer(t *testing.T) {
 	if strings.Join(argv, " ") != "settings clear dnsmasq" {
 		t.Fatalf("clear for the mesh: %v", argv)
 	}
+	// Neither values nor clear reads the layer as it stands (novox/hq ADR 0217): what a caller reads
+	// before replacing it, where it used to fall to the command's usage.
 	argv, _ = argvFor("settings", map[string]any{"module": "dnsmasq"})
-	if strings.Join(argv, " ") != "settings set dnsmasq" {
-		t.Fatalf("a set with no values falls to the command's usage: %v", argv)
+	if strings.Join(argv, " ") != "settings show dnsmasq" {
+		t.Fatalf("a call with no values reads the layer: %v", argv)
 	}
 }