Grant the bus's own module the snapshot API and nothing else (hq ADR 0235)

The night's backup of the bus takes each stream through JetStream's snapshot
API, run by the nats module under its own account. The module holding
mesh-broker is composed that account: stream names and info, the snapshot
request, its flow-control acks, its own inbox — no write, which the writers
table checks. A bus module declaring anything else to say on the bus is
refused by module check rather than silently granted nothing. The genesis
user list is unchanged: the controller's grants are.

internal/catalogue/manifest.go

@@ -1402,6 +1402,29 @@ func ParseManifest(raw []byte) (Manifest, error) {
 				m.Module, offer.Name))
 		}
 	}
+	// **The bus's own account copies the bus and says nothing on it** (novox/hq ADR 0235). The module
+	// holding mesh-broker is granted the snapshot API and nothing else, so anything it declared to say
+	// or hear on the bus would be granted nothing — refused here rather than silently dropped.
+	if _, account := m.OwnSecrets["broker"]; account && m.ClaimsSeat(BrokerSeat) {
+		var said []string
+		if len(m.EmitsAll()) > 0 {
+			said = append(said, "emits")
+		}
+		for _, f := range []struct {
+			name string
+			n    int
+		}{{"consumes", len(m.Consumes)}, {"uses", len(m.Uses)}, {"invokes", len(m.Invokes)},
+			{"state", len(m.State)}, {"reads", len(m.Reads)}} {
+			if f.n > 0 {
+				said = append(said, f.name)
+			}
+		}
+		if len(said) > 0 {
+			problems = append(problems, fmt.Sprintf(
+				"%s holds %s and declares a bus account, which is granted the bus's snapshot API and nothing "+
+					"else (novox/hq ADR 0235); its %s would be granted nothing", m.Module, BrokerSeat, strings.Join(said, ", ")))
+		}
+	}
 	for _, r := range m.Requires {
 		if r == "amqp" {
 			problems = append(problems, fmt.Sprintf(