Take the catalogue from mesh-sdk in internal/recordmirror, finish the own-manifest tests, vendor/modules.txt for the pin, the capture note and the slow-package comment (issue 1381, 6 of 6 import swaps)

With this commit no Go file outside vendor/ and the two packages about to go imports internal/catalogue, internal/overlay or mesh-host/validate, go.mod and vendor/modules.txt agree on mesh-sdk 14fd5cb68fd1, and the tree builds. testdata/beside/CAPTURED names the pinned SDK commit (conformance/events is unchanged since aa68b673). merge-check.sh's comment no longer names internal/catalogue as a slow package.

testdata/beside/CAPTURED

@@ -9,7 +9,7 @@ a second place to clean besides the catalogue itself.
 
 mesh-catalog  e0bc919d4945bb5f13f971f74643a0b714cf45da  modules/*/module.json, modules/nats/Dockerfile
 mesh-host     9d9e3a46c4f5943cfffb413d962ce48b75e2fd39  examples/foundation-first-node.lock
-mesh-sdk      aa68b67389c964ea3e573bc50630c77d6518cdab  conformance/events/module-event.json
+mesh-sdk      14fd5cb68fd157390087b41f293b569dda6c37a6  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:
 
@@ -27,7 +27,7 @@ and write the commits here. The SDK is captured at the commit go.mod pins for gi
   git -C ../mesh-sdk archive <commit> conformance/events | tar -x -C testdata/beside/mesh-sdk
 
 And from mesh-host at the same commit as its line above, the node-engine's placement guard, which
-internal/catalogue's engine_guard_test.go holds the controller's resolved-path rules to (novox/hq issue 496),
+mesh-sdk's go/catalogue engine_guard_test.go holds the controller's resolved-path rules to (novox/hq issue 496),
 kept as .captured so no Go tool reads it as this repository's code:
 
   mkdir -p testdata/beside/mesh-host/internal/apply