A module may declare its own seats (novox/hq ADR 0118)

The manifest carries seats and uses; registration refuses a mesh-* name, a
duplicate declarer, an undeclared uses or claim, a seat with no protocol, a
scope mismatch, and a holder that does not answer what its seat promises.

The parser stops judging unknown claim names, because it cannot: another
module may declare that seat, and one manifest cannot tell. The test that
encoded the old rule is rewritten to assert the refusal at registration, and
a new one pins the case the parser could not have distinguished.

Tools are declared for the first time, under their own key — serves already
means a provision's facts.

internal/catalogue/seats.go

@@ -100,9 +100,11 @@ func claimProblems(m Manifest) []string {
 	for _, c := range m.Claims {
 		seat, known := SeatNamed(c.Name)
 		if !known {
-			problems = append(problems, fmt.Sprintf(
-				"%s claims %q, which is not a seat this mesh defines (novox/hq ADR 0110) — "+
-					"the seats are: %s", m.Module, c.Name, seatNames()))
+			// Not one of the mesh's own, which no longer means it is not a seat: a module may
+			// declare its own (novox/hq ADR 0118), and whether anybody declared *this* one is a
+			// fact about the catalogue rather than about this manifest. Deferred to
+			// CatalogueProblems, which refuses it at registration — the same guarantee ADR 0110
+			// wanted, at the same moment, from a set nobody maintains by hand.
 			continue
 		}
 		if c.At() != seat.Scope {