review: hold the hosts region through composition, and say so in plan

A declaration-level test composes the shipped networking module with a
resolver and asserts /etc/hosts arrives as mesh-wireguard.fact-node-names
with into: block and region-only content, that the resolver's restart-on
still names it, and that a resource's at passes through untouched — a
composition step dropping into would otherwise go unnoticed. plan --show
marks files written into, so a region is not read as the whole file.
The rollout order is spelled out: every node's host, the controller's
own included, must be block-aware before this controller ships (hq 128).

internal/catalogue/facts.go

@@ -111,10 +111,14 @@ func FactsInto(m Manifest, r Resolution, addresses, machines map[string]string,
 			// else does. Replacing nothing, it is written on an adopted node without being held,
 			// so a machine is named on the private network before its module is taken.
 			//
-			// **Hosts first, then this.** A host older than the block mode refuses the whole
-			// declaration on an `into` it does not know — not just this file, everything — so
-			// every host is upgraded before a controller emitting it is rolled out, the same
-			// order ADR 0102 set for `into: json` (novox/hq issue 128).
+			// **Hosts first, then this — an order to roll out in, not a note.** A host older than
+			// the block mode refuses the whole declaration on an `into` it does not know: not just
+			// this file, everything the node was sent, so it stops converging on anything at all.
+			// Every node on the private network receives this fact, so every node's host —
+			// the controller's own machine included, which would otherwise stop taking the
+			// declaration that runs the controller — must run a block-aware host before a
+			// controller emitting it is rolled out. The same order ADR 0102 set for `into: json`
+			// (novox/hq issue 128).
 			file["into"] = "block"
 		}
 		out = append(out, file)