Merge main: the trunk renamed the seats and made them data

Both branches changed the seat set from the same starting point, so every number
collided and every `mesh-*` name existed twice. The trunk's numbers and names win:
this branch's records became 0129/0130 and its migrations 0037/0038, and the
hardcoded rename map gave way to the trunk's `seat_alias` table — a rename is a
row now (ADR 0122), not a recompile.

Three of my checks were wrong and the merge is what showed it:

A seat with an empty protocol is a marker, not an incomplete declaration. Most
node-scoped seats are markers — which module is this machine's packet filter —
and refusing one refused most of the set, the showcase module included. A
mistyped field name is already refused by the parser, so an empty protocol was
written as one deliberately.

A claim on a seat this manifest does not declare is not the parser's to judge. A
module may hold a seat another module declared; that is the whole reason ADR 0126
has callers name the seat and not its provider. Whether the seat exists is a fact
about the catalogue, so the refusal is at registration, where every declaration
is in view.

And a seat may share a name with the provision it delivers. `git`, the npm
registry and the artifact store still do, because renaming a delivering seat
cascades to every consumer requiring it, with a window where a holder stops
resolving mid-flight. The trunk deferred exactly those three on purpose.

Full suite green against a real NATS and store.

internal/catalogue/broker_seat_test.go

@@ -71,9 +71,9 @@ func TestTheAmqpBrokerDoesNotContendForTheSeat(t *testing.T) {
 // "the package registry is served on <nil>", which does not say "you renamed an interface".
 func TestRenamingASeatDidNotRenameTheInterfaceItDelivers(t *testing.T) {
 	for _, pair := range []struct{ seat, delivers string }{
-		{"mesh-git", "git"},
-		{"mesh-npm-package-registry", "npm-package-registry"},
-		{"mesh-artifact-store", "artifact-store"},
+		{"git", "git"},
+		{"npm-package-registry", "npm-package-registry"},
+		{"the-artifact-store", "artifact-store"},
 		{"mesh-store", "postgres-database"},
 		{"mesh-broker", "mesh-bus"},
 	} {
@@ -86,19 +86,16 @@ func TestRenamingASeatDidNotRenameTheInterfaceItDelivers(t *testing.T) {
 				"interface with it, and every consumer requiring it would stop resolving",
 				pair.seat, s.Delivers, pair.delivers)
 		}
-		if _, isSeat := SeatNamed(pair.delivers); isSeat {
-			t.Errorf("%q is both an interface and a seat name; one of the renames was incomplete",
-				pair.delivers)
-		}
+		// **Three of these deliberately share a name with what they deliver**, and that is not an
+		// incomplete rename. Renaming a seat that delivers a provision cascades to every consumer
+		// requiring it, with a mesh-wide window where a holder stops resolving mid-flight — so the
+		// trunk deferred exactly those three (novox/hq ADR 0121) while renaming the node-scoped ones.
+		// What this test is for is the other direction: that renaming a seat never moves the
+		// interface, which once produced "the package registry is served on <nil>".
 	}
 }
 
-// And a manifest written against an old seat name is told what it became, rather than refused as
-// unknown — the courtesy the `needs`/`own-secrets` rename already sets.
-func TestAnOldSeatNameSaysWhatItBecame(t *testing.T) {
-	m := Manifest{Module: "old", Claims: []Claim{{Name: "the-catalogue", Scope: ScopeMesh}}}
-	got := strings.Join(claimProblems(m), "; ")
-	if !strings.Contains(got, "the-catalogue") || !strings.Contains(got, "mesh-catalog") {
-		t.Fatalf("the refusal does not name both the old and the new: %q", got)
-	}
-}
+// A manifest written against an old seat name is told what it became rather than refused as
+// unknown. **That map is the controller's store now, not this package** (novox/hq ADR 0122): a
+// rename is a row, so the courtesy survives a rename nobody recompiled for. Checked where the
+// table is read, not here, where there is no longer a hardcoded list to check against.