review: hold the hosts region through composition, and say so in plan

A declaration-level test composes the shipped networking module with a
resolver and asserts /etc/hosts arrives as mesh-wireguard.fact-node-names
with into: block and region-only content, that the resolver's restart-on
still names it, and that a resource's at passes through untouched — a
composition step dropping into would otherwise go unnoticed. plan --show
marks files written into, so a region is not read as the whole file.
The rollout order is spelled out: every node's host, the controller's
own included, must be block-aware before this controller ships (hq 128).

cmd/mesh-controller/plan.go

@@ -923,12 +923,26 @@ func planCommand(ctx context.Context, args []string) error {
 			if !ok {
 				continue
 			}
-			fmt.Printf("\n--- %v  %v ---\n%s", r["id"], r["path"], content)
+			fmt.Printf("\n--- %s ---\n%s", shownAs(r), content)
 		}
 	}
 	return nil
 }
 
+// shownAs is the heading `plan --show` puts over a resource's content.
+//
+// **A file written into says so.** Its content is the mesh's part of a file that is otherwise the
+// machine's — the keys of a JSON document (novox/hq ADR 0102), the region of a hosts file (issue
+// 128). Shown under a bare path it reads as the whole file, and a person checking what a take
+// replaces would see a hosts file of a dozen lines where the machine keeps thirty.
+func shownAs(r map[string]any) string {
+	heading := fmt.Sprintf("%v  %v", r["id"], r["path"])
+	if into, ok := r["into"].(string); ok && into != "" {
+		heading += fmt.Sprintf(" (written into, %s)", into)
+	}
+	return heading
+}
+
 // licencesFor is what this node can be answered with by record, and what it was put on.
 //
 // A mesh with no licences at all is the ordinary case and must not be an error: every existing