Withdraw the mount check: it refuses the builder

The rule was right about data and wrong about everything else. The
builder mounts the container runtime's socket, which is not its data,
does not belong to it, and must not be declared as one of its
directories — and the check refused the builder's own manifest.

Caught by the lab, though not honestly: the run was already going when
this went in, so the builder binary was rebuilt mid-run with the check
compiled into it and the failure was mine, not the mesh's. Confirmed
against the manifest directly rather than inferred from the log.

What it was protecting is real and stands — the fourteen mounts are all
declared. But enforcing it needs a way to tell "the directory my data
lives in" from "a machine facility I was granted", and the mesh has no
vocabulary for the second. `capabilities` is the closest thing and does
not name paths. That is a design decision, so it goes back to
04-ISSUES/026 rather than being invented here to make a check pass.

The check that every real manifest still parses is kept. It costs
nothing and it is how the next attempt at this finds out sooner.

internal/catalogue/machineside_test.go

@@ -1,9 +1,6 @@
 package catalogue
 
-import (
-	"strings"
-	"testing"
-)
+import "testing"
 
 // A module with nothing that publishes binds what it binds, and the mesh may not move it.
 //
@@ -61,35 +58,3 @@ func TestAPortNotInTheMappingIsNotFound(t *testing.T) {
 			at, mayAssign)
 	}
 }
-
-// A bind mount the module never declared is refused where it is written.
-//
-// The container runtime creates a missing bind source itself, as root, with a mode it picks. So
-// the module's own owner and mode never reach the directory holding its data, and the rule that
-// keeps data when a module goes away (novox/hq ADR 0030) does not cover it — that rule is written
-// in terms of declared directories, and the mesh has never heard of this one.
-func TestAMountNothingDeclaresIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"store","resources":[` +
-		`{"id":"server","type":"container","name":"store","image":"x@sha256:` +
-		`0000000000000000000000000000000000000000000000000000000000000000",` +
-		`"volumes":["/services/store/data:/var/lib/data"]}]}`))
-	if err == nil {
-		t.Fatal("a container mounting a path no resource declares was accepted; the runtime " +
-			"would create it as root and the module's owner and mode would never apply")
-	}
-	if !strings.Contains(err.Error(), "/services/store/data") {
-		t.Fatalf("refused without naming the path, which leaves the author guessing: %v", err)
-	}
-}
-
-// And declaring it is enough — including declaring the directory above it.
-func TestAMountUnderADeclaredDirectoryIsAccepted(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"store","resources":[` +
-		`{"id":"state","type":"directory","path":"/services/store","mode":"0700"},` +
-		`{"id":"server","type":"container","name":"store","image":"x@sha256:` +
-		`0000000000000000000000000000000000000000000000000000000000000000",` +
-		`"volumes":["/services/store/data:/var/lib/data"]}]}`))
-	if err != nil {
-		t.Fatalf("a module that said where its data lives was refused anyway: %v", err)
-	}
-}