Refuse token issue --adopted for a converged node and point to adopt, rather than flip it quietly (hq ADR 0100)

cmd/mesh-controller/nodes_test.go

@@ -139,11 +139,16 @@ func TestATokenIssuedAdoptedSaysSoAndReissuingDoesNotConverge(t *testing.T) {
 	if !again.Node.Adopted {
 		t.Fatal("re-issuing without --adopted converged the node; converging is its own act")
 	}
-	existing, err := issueFor(ctx, open.inventory, "laptop", "", true, time.Hour)
-	if err != nil {
+	// --adopted for a node already converged is refused, and points at the act that does it.
+	if _, err := issueFor(ctx, open.inventory, "laptop", "", true, time.Hour); err == nil ||
+		!strings.Contains(err.Error(), "adopt laptop") {
+		t.Fatalf("--adopted on a converged node was not refused: %v", err)
+	}
+	if n, _ := open.inventory.NodeByName(ctx, "laptop"); n.Adopted {
+		t.Fatal("a refused token flipped the node to adopted")
+	}
+	// And said for a node that is adopted already, it is the ordinary re-issue.
+	if _, err := issueFor(ctx, open.inventory, "joiner", "", true, time.Hour); err != nil {
 		t.Fatal(err)
 	}
-	if !existing.Node.Adopted {
-		t.Fatal("--adopted on an existing record did not make it adopted")
-	}
 }