Say the setuid search's quiet in the tests' words, and pin the node-engine at its reviewed head (hq issue 361)

cmd/mesh-controller/probe_agent_root_test.go

@@ -201,7 +201,7 @@ func TestRootFreeIsAnsweredOnlyByTheServingController(t *testing.T) {
 }
 
 // The confirmation review of 2026-10-09: ADR 0266's quiet window (#175) keeps the self-check from raising
-// agent-can-become-root while the node-engine's first setuid search runs. It must not make root-free answer free:
+// agent-can-become-root while the node-engine's setuid search runs and no complete one judges. It must not make root-free answer free:
 // root-free needs a complete, fresh verdict. A verdict still waiting for the search is "not judged" to
 // agentConfined, so the machine is not root-free, whatever the quiet says — and the same statement, complete
 // and healthy, is the control.
@@ -224,12 +224,12 @@ func TestAMachineWaitingForItsFirstSetuidSearchIsNotRootFree(t *testing.T) {
 		t.Fatal("the statement is not one the quiet window counts as waiting for the search")
 	}
 	if v := judged(pending); v.Free {
-		t.Errorf("a machine whose first setuid search is pending was judged root-free: %+v", v)
+		t.Errorf("a machine whose setuid search is pending was judged root-free: %+v", v)
 	}
 }
 
 // The confirmation review of 2026-10-09, on #154 beside ADR 0266: D-root keeps ADR 0266's quiet window — nothing
-// raised while the one thing unjudged is the first setuid search, within its bound — while the root-free verb
+// raised while the one thing unjudged is the setuid search, within searchQuietFor — while the root-free verb
 // still answers the machine not free; and D-root's condition has a key of its own, apart from DA's.
 func TestRootNotFreeIsQuietWhileTheFirstSearchRunsAndKeyedApartFromDA(t *testing.T) {
 	entries := []inventory.Entry{{Manifest: catalogue.Manifest{Module: "telegram", RunsAs: "telegram"}, On: []string{"anchor"}}}
@@ -241,21 +241,21 @@ func TestRootNotFreeIsQuietWhileTheFirstSearchRunsAndKeyedApartFromDA(t *testing
 		quiet:    func(context.Context, string, time.Time) bool { return true }}
 	trusted := trustedMachines(entries)
 	if got := rootObservations(context.Background(), r, trusted, rootNow); len(got) != 0 {
-		t.Errorf("raised while the first search runs: %+v", got)
+		t.Errorf("raised while the search runs: %+v", got)
 	}
 	if v := judgeRootFree(context.Background(), r, []string{"anchor"}, rootNow)[0]; v.Free || !v.Quiet {
-		t.Errorf("root-free while the first search runs: %+v", v)
+		t.Errorf("root-free while the search runs: %+v", v)
 	}
 	// Quiet hides nothing else: the login shell served as well is said.
 	r.heard = map[string]map[string]map[string]bool{loginShellSeat: {"execute": {"anchor": true}}}
 	if got := rootObservations(context.Background(), r, trusted, rootNow); len(got) != 1 {
 		t.Errorf("a second failure was kept quiet: %+v", got)
 	}
-	// Past its bound, said.
+	// Past searchQuietFor, said.
 	r.heard, r.quiet = map[string]map[string]map[string]bool{}, func(context.Context, string, time.Time) bool { return false }
 	got := rootObservations(context.Background(), r, trusted, rootNow)
 	if len(got) != 1 {
-		t.Fatalf("a search past its bound was not said: %+v", got)
+		t.Fatalf("a search past searchQuietFor was not said: %+v", got)
 	}
 	// One key per judgement: DA's is machine.<m>.agent-root, this one its own.
 	da := conditions.Observation{Scope: conditions.ScopeMachine, ID: "anchor", Token: "agent-root", Machine: "anchor"}