Settings: changing a module's config without editing its file

Managed files are generated and never edited, so somebody's intention about one
has to live where the generator can see it. It does now: the module ships
defaults, settings go over the top by key, and the file is produced from both.
Upstream can rewrite its half freely and the keys somebody chose survive.

Two layers, both from the start. The mesh's settings for a module, then one
machine's over those. A node that differs is expressed by differing, rather
than by restating everything the rest already say -- which would pin all of it
against future changes for no reason.

An override beats a default and there is nothing to resolve. A setting is a
statement about that key made deliberately; the default was only ever what to
do in the absence of one. So when upstream changes a key somebody has set,
there is no conflict, no merge markers, and nothing to ask.

Nested blocks merge and lists are replaced whole. Setting one field of a block
must not delete its siblings, or every setting would restate the whole block
and pin all of it. A list that merged element-wise could neither be shortened
nor reordered, and there is no correct guess about which element is "the same
one".

A module can keep specific keys for itself -- a socket path its own code
depends on -- and setting one is REFUSED rather than ignored. A setting quietly
dropped is somebody believing they changed something.

Settings that reach nothing are named at the moment they would be used, not
discovered later by the machine not behaving differently.

`plan --files` prints what a machine would be given before it is sent, because
"1 resource" does not tell you whether the merge landed.

One test kept with a note that it does not defend this code: output stability
comes from Go's encoder sorting map keys, so it passes with the merging
removed. Worth having as the thing that would catch a change of encoder, but it
is not evidence about anything written here, and it was checked.

internal/catalogue/resolve.go

@@ -272,15 +272,22 @@ func checkResources(modules []Manifest) []string {
 	return problems
 }
 
-// Declaration is everything the resolved modules put on the node, as the host reads it.
+// SettingsBy is the layers that apply to each module, keyed by module name.
+type SettingsBy map[string][]Layer
+
+// Declaration is everything the resolved modules put on the node, with settings applied.
 //
 // Resource identities are prefixed with the module they came from. Two modules may reasonably
 // both call something "config", and without this the second would silently replace the first —
 // the node applying one of them and reporting success.
-func (r Resolution) Declaration() []map[string]any {
+func (r Resolution) Declaration(settings SettingsBy) ([]map[string]any, error) {
 	var out []map[string]any
 	for _, m := range r.Modules {
-		for _, resource := range m.Resources {
+		for _, unsettled := range m.Resources {
+			resource, err := ApplySettings(unsettled, settings[m.Module])
+			if err != nil {
+				return nil, err
+			}
 			copied := map[string]any{}
 			for k, v := range resource {
 				copied[k] = v
@@ -298,5 +305,5 @@ func (r Resolution) Declaration() []map[string]any {
 			out = append(out, copied)
 		}
 	}
-	return out
+	return out, nil
 }