Pin the group's mesh-sdk ef1ec1c9 and capture its conformance files there, so the sweep builds on kvlimit and the named readers (issue 774)

The sweep's controller changes use mesh-sdk's go/kvlimit and the ReadsAnnouncedBy that grants named
readers. At ef1ec1c9 mesh-config is a named reader of the controller's lease (its take-over reads it,
ADR 0561 §3), so the read test now expects it granted and a module not named refused. The captured SDK
(testdata/beside, conformance/events) is taken again at the pinned commit, as CAPTURED says; its file
is unchanged.

go.mod

@@ -3,7 +3,7 @@ module github.com/novox/mesh-controller
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030172623-ef1ec1c93544
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0

go.sum

@@ -1,7 +1,7 @@
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5 h1:E5stfIeCN6uYgA9TCv+4K8JgaURg3zQppvUgJLaDMP4=
 git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5/go.mod h1:4wyoCr6IIIIarEUuROThWDj7DAvJvIidqMjWcpSnOwE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0 h1:lKU3HjNXGiVbLW2hUgFjU/TMTUYMlNnnmZxG5T7biQA=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030172623-ef1ec1c93544 h1:k7t20mLhKKZADBiGhTofzmwm61OK3jU1Z7Dz3Zj8Bi8=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030172623-ef1ec1c93544/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/inventory/judge_reads_test.go

@@ -9,7 +9,7 @@ import (
 )
 
 // Sweep 2026-10-30 (issue 774): a read is judged for its reader. The controller's lease, which its announcement marks
-// readable by nobody, is granted to the parts named for it (ADR 0561 §3) and refused to every other; a state its owner
+// readable by nobody, is granted to the parts named for it (ADR 0561 §3) and refused to every other (mesh-config named since mesh-sdk ef1ec1c9); a state its owner
 // announced readable is granted; one it keeps and did not is refused; an owner that announced nothing is read as before.
 // Each refusal is said, and a refusal already said is not said again.
 func TestAReadIsJudgedForItsReader(t *testing.T) {
@@ -23,7 +23,8 @@ func TestAReadIsJudgedForItsReader(t *testing.T) {
 	}{
 		"the lease, by the vault":            {"mesh-vault", "mesh-controller.lease", true},
 		"the lease, by the grants part":      {"mesh-grants", "mesh-controller.lease", true},
-		"the lease, by a module not named":   {"mesh-config", "mesh-controller.lease", false},
+		"the lease, by mesh-config":          {"mesh-config", "mesh-controller.lease", true},
+		"the lease, by a module not named":   {"restic", "mesh-controller.lease", false},
 		"a readable state":                   {"reader", "owner.open", true},
 		"a state kept and not readable":      {"reader", "owner.closed", false},
 		"an owner that announced nothing":    {"reader", "quiet.any", true},

testdata/beside/CAPTURED

@@ -9,7 +9,7 @@ a second place to clean besides the catalogue itself.
 
 mesh-catalog  f3a57dcc56fb6c198095cafd11d0decff9f720c4  modules/*/module.json, modules/*/files, modules/*/templates, predefined.json
 mesh-host     9d9e3a46c4f5943cfffb413d962ce48b75e2fd39  examples/foundation-first-node.lock
-mesh-sdk      2da0de75c3f0087cff9c2f5ef789ca6dc3c59045  conformance/events/module-event.json
+mesh-sdk      ef1ec1c93544f0fc12b2dca608167bf2af11a846  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it: