The mesh owns the operator's ~/.ssh: account fact + home-scoped resources (to-be 29)

A node carries its operator account (name + home; migration 0036, Node.Account,
SetAccount, 'node account' CLI). The account and its home are offered as
machine facts ${machine:account} / ${machine:account-home}, and machineInto
now resolves placeholders in a resource's path and owner (not just content), so
a module writes into a person's home naming what it cannot know. A RosterFile
gains Home: the file is placed under the account's home and chowned to it, its
template sees each node's Account, and a machine with no account gets none —
this is how the ssh Host blocks for every node reach a person's ~/.ssh. Roster
carries per-node accounts (Rendering.Accounts). Tested, including ssh-client
composed end-to-end. Not deployed.

cmd/mesh-controller/plan.go

@@ -83,9 +83,17 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 		return catalogue.Resolution{}, nil, err
 	}
 
+	// The operator account this node logs a person in as, and where its home is (novox/hq to-be
+	// 29) — carried so a home-scoped file's owner and path resolve for this machine.
+	who, err := inv.NodeByName(ctx, nodeName)
+	if err != nil {
+		return catalogue.Resolution{}, nil, err
+	}
+
 	resolved, err := catalogue.Resolve(shelf, assigned,
 		catalogue.Node{Name: nodeName, Site: site, Capabilities: capabilities,
-			At: onNetwork[nodeName], PublicDomain: publicDomain}, world)
+			At: onNetwork[nodeName], PublicDomain: publicDomain,
+			Account: who.Account, AccountHome: who.AccountHome}, world)
 	if err != nil {
 		return catalogue.Resolution{}, nil, err
 	}
@@ -520,6 +528,19 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
 
+	// Each machine's operator account, so an ssh Host block can name the login for every node
+	// (novox/hq to-be 29). Keyed by the bare node name, which entriesFrom falls back to.
+	allNodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
+	accounts := map[string]string{}
+	for _, n := range allNodes {
+		if n.Account != "" {
+			accounts[n.Name] = n.Account
+		}
+	}
+
 	// And every routed name → the node that serves it (novox/hq ADR 0066). Alongside the
 	// `<node>.internal` names above, so a container — or an internal ACME validator — resolves a
 	// routed name to the proxy that serves it, mesh-wide. The mesh publishes the names it was told
@@ -604,7 +625,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		Settings: settings, Generators: gens, Grants: grants, Needed: needed, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
 		Machines: machines,
-		Suffix:   overlay.Suffix(), MeshRange: meshRange, Foundation: foundation, Kept: kept,
+		Suffix:   overlay.Suffix(), MeshRange: meshRange, Accounts: accounts, Foundation: foundation, Kept: kept,
 		Adopted: record.Adopted,
 		Given:   given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, Built: built,
 	}, record, nil