Pin mesh-sdk 007b6fd, the release's final sdk, so the controller reads the release's manifests and composes as the group does (issue 774)

The sdk now refuses an offer that says no credential form (6b8c694, ADR 0570). So:
- the catalogue copy in testdata/beside is captured again at the release branch's catalogue 8ae8e88d, whose offers each
  say one, and the sdk's conformance events at 007b6fd, as CAPTURED asks;
- the fixtures of identity_bound_test and issued_test say the form their rows meant: pair for a login of each
  consumer's own, none for a keyless provision. No behaviour of the controller changed.

testdata/beside/mesh-catalog/modules/gitea/module.json.captured

@@ -40,6 +40,7 @@
   ],
   "emits": [
     "repo.created",
+    "repo.writable",
     "issue.opened",
     "pull.merged",
     "pull.updated",
@@ -181,6 +182,12 @@
       "trusted": true,
       "default": {}
     },
+    "check-gates-merge": {
+      "type": "boolean",
+      "description": "Whether gitea_merge_pull_request judges mesh/check before it merges. True (the default): a head merges only on a passing mesh/check judged against the trunk's head (ADR 0447, ADR 0534 §4). False (the operator, 2026-10-25 22:56: \"run the check locally only, but not as a gate, it loses us too much time\"): a head the operator's Approve names in approved_heads merges whatever its mesh/check says (pending, failed, missing or judged on an older trunk); a head that moved, a branch no rule guards and a merge git refuses are still refused. Set together with mesh-delivery-gate's check-gates-merge.",
+      "trusted": true,
+      "default": true
+    },
     "main-mergers": {
       "type": "list",
       "description": "The forge logins that may merge into main beside the tools' account, on every repository of the organisation (ADR 0534 §2): the operator's own, so the operator can always merge by hand at the forge. The tools' account is always on main's merge whitelist; no agent's account belongs here.",
@@ -316,7 +323,8 @@
       "takes-config": [
         "url",
         "keep-main-rules",
-        "main-mergers"
+        "main-mergers",
+        "check-gates-merge"
       ]
     },
     {
@@ -391,6 +399,7 @@
   "provides": [
     {
       "name": "npm-package-registry",
+      "credential": {"form": "pair"},
       "scope": "mesh",
       "identity": {
         "max": 40,
@@ -399,6 +408,7 @@
     },
     {
       "name": "git",
+      "credential": {"form": "none"},
       "scope": "mesh"
     },
     {
@@ -411,6 +421,7 @@
     },
     {
       "name": "forge-account",
+      "credential": {"form": "none"},
       "scope": "mesh"
     }
   ],
@@ -537,6 +548,7 @@
           "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
           "MESH_GITEA_ORIGINS_FILE": "${dir:mesh-state}/origins",
           "MESH_GITEA_SSH_PORT": "222",
+          "MESH_GITEA_HOST_KEY_FILE": "${dir:data}/ssh/ssh_host_ed25519_key.pub",
           "MESH_FORGE_HOST_FILE": "/etc/gitea/forge-host"
         }
       }
@@ -554,11 +566,14 @@
     "announced"
   ],
   "reads": [
-    "mesh-controller.assignments",
+    "mesh-provisioner.plans",
+    "mesh-provisioner.provisions",
     "ssh-client.keys",
     "mesh-build-go.keys",
     "mesh-build-node.keys",
     "mesh-build-image.keys",
-    "mesh-delivery-checker.owed"
+    "mesh-delivery-checker.owed",
+    "mesh-delivery-indexer.modules",
+    "mesh-delivery-gate.source"
   ]
 }