Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

networking required mesh-wireguard and nothing else; machines are assigned the network directly.
module forget refuses a provided module, so a retired one is removed at start once no machine has it.
Guard route-proxy's public account directory against a reissue.

internal/overlay/seat_test.go

@@ -13,7 +13,7 @@ import (
 // has no module.json for a test reading the catalogue to find. Parsed with the real parser, so a
 // set that forgot this seat refuses the control plane's own module here rather than on a machine.
 func TestThePrivateNetworksClaimIsASeatTheMeshDefines(t *testing.T) {
-	for _, composed := range []map[string]any{Manifest(), DomainManifest()} {
+	for _, composed := range []map[string]any{Manifest()} {
 		raw, err := json.Marshal(composed)
 		if err != nil {
 			t.Fatal(err)