A consumer that stopped asking is withdrawn

Found by testing removal, which is the half nobody tests.

A grant was emitted for every secret the mesh held, whether or not the
machine still asked for it. So a consumer that was unassigned kept
appearing in its provider's manifest — and the provisioner's rule about
removing what nobody asks for can only fire if the mesh stops asking. The
login would have stayed live for ever, and nothing would have said so.

Skipped where the declaration is built rather than where grants are
gathered, so the rule holds whoever gathers them. No credential file is
written for a withdrawn consumer either, or the provisioner would find a
file its manifest does not mention and have to guess what that means.

The secret itself is deliberately kept. It is sealed and unusable to the
mesh, and a machine that comes back gets what it had — what withdraws the
login is the manifest, which is the thing that reconciles.

internal/catalogue/declaration.go

@@ -114,6 +114,16 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 				if g.Provision != to {
 					continue
 				}
+				if g.From == "" {
+					// Nothing on that machine asks for this any more. Skipped here rather than
+					// where grants are gathered, so the rule holds whoever gathers them.
+					//
+					// **This is how a credential is withdrawn.** The provisioner removes what
+					// nobody asks for, and it can only do that if the mesh stops asking — a
+					// consumer that was unassigned would otherwise keep a working login for ever,
+					// and nothing would say so.
+					continue
+				}
 				resources = append(append([]map[string]any{}, resources...), map[string]any{
 					"id":     GrantID(to, g.Consumer),
 					"type":   "file",
@@ -245,6 +255,11 @@ func (r Resolution) contributions(settings SettingsBy, grants []Grant,
 		return sorted[i].Consumer < sorted[j].Consumer
 	})
 	for _, g := range sorted {
+		if g.From == "" {
+			// As above: nothing on that machine asks for this any more, so the provider is not
+			// told about it and withdraws the login on its next pass.
+			continue
+		}
 		out[g.Provision] = append(out[g.Provision], Contribution{
 			From: g.From, Node: g.Consumer, Values: g.Values,
 			Secret: grantPath(directories[g.Provision], g.Consumer),