Judge a machine root-free only on a positive, fresh measure, and believe a verified sender only there (hq ADR 0259 §8, review H2/H3)

The agent-root probe read the sudo module's answer, given in the machine's runtime as the very account
an agent could become, and took a missing account, a missing answer or no accounts as a pass. One
judgement now decides: the machine names an agent account its node-engine judged unable to become
root within 15 minutes (agentConfined, mesh-controller #164), and the login shell's execute is not
served there; anything not read is not free. The probe raises agent-root on it, the new root-free
verb answers it live for the router, and a push composes verified-sender for a kind only while its
machine and the router's pass it.

cmd/mesh-controller/push.go

@@ -1250,11 +1250,14 @@ func issueMemberships(ctx context.Context, open *stores, server *link.Server, se
 	if err != nil {
 		return err
 	}
-	where := broker.PlacementsOf(records, records.Interchangeable)
 	bus, ok := server.Bus().(link.OverNATS)
 	if !ok {
 		return nil
 	}
+	// Which machines are root-free now (novox/hq ADR 0259 §8): a channel's verified sender is composed for the
+	// router only from one, beside a router on one. Judged once per push, by the root-free verb's judgement.
+	records.RootFree = rootFreeNow(ctx, newRootReader(ctx, open.inventory, bus.Conn), records.Nodes, time.Now())
+	where := broker.PlacementsOf(records, records.Interchangeable)
 	// **Every declared state's bucket, before the memberships that name it** (novox/hq ADR 0201). The
 	// raise at start asserts them too, but a module registered and assigned since would otherwise have
 	// its bucket only after the control plane next restarts — found the first time a module declared