Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

networking required mesh-wireguard and nothing else; machines are assigned the network directly.
module forget refuses a provided module, so a retired one is removed at start once no machine has it.
Guard route-proxy's public account directory against a reissue.

cmd/mesh-controller/modules.go

@@ -40,7 +40,12 @@ func providedModules() []catalogue.Manifest {
 		// and neither could be swapped for anything, which is the test of whether a thing is a
 		// module at all (novox/hq ADR 0040). They existed because computed output needed somewhere
 		// to live, and now a module says where it wants it — `facts` in its own manifest.
-		overlay.Manifest(), overlay.DomainManifest(),
+		//
+		// **And the bundle that required it is gone** (novox/hq ADR 0226): `networking` named this
+		// module's requirement and nothing else, so every machine carried two modules for one
+		// network. A machine is assigned the private network itself; what a release stops shipping
+		// is retired at the next start (stores.go, Inventory.RetireUnshipped).
+		overlay.Manifest(),
 	} {
 		var m catalogue.Manifest
 		b, _ := json.Marshal(raw)
@@ -494,8 +499,8 @@ const theBrokerSeat = "mesh-broker"
 // says. Only when nothing holds the seat yet (genesis raised the broker as plumbing and no module
 // has adopted it) does the hub stand in, which is where the foundation is by convention.
 //
-// "On the overlay" is what `whereEveryoneIs` answers — a machine that RESOLVED the networking
-// module — not "has an address", which is true of every placed machine and says nothing about
+// "On the overlay" is what `whereEveryoneIs` answers — a machine that RESOLVED the private network
+// — not "has an address", which is true of every placed machine and says nothing about
 // whether anything can reach it (novox/hq issue 059). A node not on the overlay — at genesis,
 // before any `overlay place`, which is when the builder's account is issued — keeps the genesis
 // address, so nothing about bring-up changes. This is issue 055, corrected by 059.

cmd/mesh-controller/stores.go

@@ -73,6 +73,22 @@ func migrate(ctx context.Context) error {
 		}
 		fmt.Printf("provided %s\n", m.Module)
 	}
+	// And what an earlier release shipped and this one does not goes (novox/hq ADR 0226) — unless a
+	// machine still has it, which is said rather than overridden.
+	var shipped []string
+	for _, m := range provided {
+		shipped = append(shipped, m.Module)
+	}
+	retired, kept, err := inv.RetireUnshipped(ctx, shipped)
+	if err != nil {
+		return err
+	}
+	for _, name := range retired {
+		fmt.Printf("retired %s: the control plane no longer ships it\n", name)
+	}
+	for name, why := range kept {
+		fmt.Printf("kept %s, which the control plane no longer ships: %s\n", name, why)
+	}
 	// The seats the mesh ships with, into the table that now holds the set (novox/hq ADR 0122).
 	// Idempotent: fills an empty table on first boot, adds a seat a release ships, and leaves an
 	// operator's changes in the table as they are.