Let the controller ask an issued credential's tool in its own name, and seal it again over a remade pair (hq issue 526, ADR 0305)

The bus left the controller out of the caller-named grants, so issued could never reach plex's tool; the
controller is now granted exactly the tools of offers whose software issues the credential, composed from
the records, so the installer's first user list is unchanged. A pair remade on a key change or accepted by
hand kept the issued stamp and was never sealed again; those writes now clear it.

cmd/mesh-controller/issued.go

@@ -27,6 +27,12 @@ import (
 // (issue 365) — with a sealing key made for this one call. The tool answers only the controller, the value sealed
 // to that key; the controller opens it, seals it to every holder and forgets it, as the desk's value is (ADR 0277
 // §23). Asking again fetches the same value again, and a value every holder already holds is not sealed anew.
+//
+// **What this trusts: the provider's machine.** The answer is taken from whoever answers the provider's tool
+// subject on the provider's machine first. On that machine its runtime serves the subject for every module it
+// carries, so anything that runtime runs, or anything else granted that subject there, could answer before the
+// provider does and hand the controller a value of its own. ADR 0305 accepts that by trusting the provider's
+// machine, as the provider itself is trusted; the bus keeps every other machine from answering it.
 
 // handActIssued is the verb a change of an issued value is recorded under: the mesh working as decided.
 const handActIssued = "secret issued"