Take the catalogue from mesh-sdk in internal/recordmirror, finish the own-manifest tests, vendor/modules.txt for the pin, the capture note and the slow-package comment (issue 1381, 6 of 6 import swaps)

With this commit no Go file outside vendor/ and the two packages about to go imports internal/catalogue, internal/overlay or mesh-host/validate, go.mod and vendor/modules.txt agree on mesh-sdk 14fd5cb68fd1, and the tree builds. testdata/beside/CAPTURED names the pinned SDK commit (conformance/events is unchanged since aa68b673). merge-check.sh's comment no longer names internal/catalogue as a slow package.

internal/recordmirror/mirror_store_test.go

@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 

internal/recordmirror/readers_test.go

@@ -17,7 +17,7 @@ import (
 
 // mayNameAMirror are the files of the controller that may name a record mirror's bucket outside their tests:
 // where the buckets are defined, asserted and granted (internal/broker), the list a reader names in `reads`
-// (internal/catalogue/state.go), and each mirror's own writer (this package and the loop that runs it). The
+// (the catalogue's state.go, now mesh-sdk's), and each mirror's own writer (this package and the loop that runs it). The
 // audit of a mirror against its store (ADR 0289 §4, issue 419) joins this list when it is built.
 var mayNameAMirror = []string{
 	// The chain opens its buckets, the assignments' among them, which stopped being a mirror when the chain took them
@@ -28,7 +28,6 @@ var mayNameAMirror = []string{
 	// The grant of a machine's own keys of the assignments mirror to its provisioner client (design 57 P3).
 	"internal/broker/provisioner.go",
 	"internal/broker/writers.go",
-	"internal/catalogue/state.go",
 }
 
 // The packages whose names stand for a mirror, by import path, and the names in each.