Refuse any change through a verb to a module with a trusted mergeable file

A mergeable file takes any key, not only those its content names, so an
empty runtime configuration a provider reads took a url of the caller's
through the settings verb (hq issue 340 review).

cmd/mesh-controller/modules.go

@@ -1081,6 +1081,16 @@ func throughAVerb() (string, bool) {
 	return verb, verb != ""
 }
 
+// sameLayer says whether two layers hold the same values, an absent layer and an empty one alike.
+func sameLayer(a, b map[string]any) bool {
+	if len(a) == 0 && len(b) == 0 {
+		return true
+	}
+	ra, _ := json.Marshal(a)
+	rb, _ := json.Marshal(b)
+	return string(ra) == string(rb)
+}
+
 // refuseTerminalSettingsThroughAVerb refuses a layer change through a verb that would add, change or remove
 // places or accesses; a change that leaves both as they were is not refused.
 func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inventory, before, after map[string]any,
@@ -1095,6 +1105,14 @@ func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inve
 	if err != nil {
 		return fmt.Errorf("which settings of %s are the terminal's cannot be read, so nothing was changed: %w", module, err)
 	}
+	// A trusted mergeable file takes any key, so its module's whole layer is the terminal's (novox/hq issue 340).
+	if files := catalogue.TrustedMergeable(shelf[module]); len(files) > 0 && !sameLayer(before, after) {
+		return fmt.Errorf("the settings of %s on %s are set at the controller's terminal only, never through a verb (this "+
+			"line came through %q): %s merges whatever key a layer sets into a file root or a consumer trusts, so "+
+			"any key could point the module at a listener of the caller's, and whoever may call a verb includes "+
+			"agents (novox/hq issue 340; a file nothing trusts says \"trusted\": false). Nothing was changed",
+			module, where, verb, strings.Join(files, ", "))
+	}
 	for _, key := range catalogue.TerminalKeys(shelf[module]) {
 		was, _ := json.Marshal(before[key])
 		now, _ := json.Marshal(after[key])