Hold a joining module at the build it ran, own its directories by its own group, and take a library only when its act is done (hq ADR 0328 review, ADR 0334)

A held module is composed exactly as before it joined, at the build its machine runs, so its port, resources and
contributions stay. A joining module's directories belong to its user and its own group, and its tools' directories
are refused closed to that group; the runner joins it where the engine can say so. A take records the root and is
taken only when the engine states the act done. Libraries' paths and verdicts count modules pulled in by a
requirement, and a unit takes the identity.

internal/link/protocol.go

@@ -451,6 +451,11 @@ const IdentityContract = 5
 // it sent; five, ADR 0325's, is sent nothing new.
 const LibraryContract = 6
 
+// OwnGroupContract is the statement of an engine that also puts the tool runner's account in a joining module's own
+// group, named by an identity's `runner` (novox/hq ADR 0334 §2). Not stated by any engine yet: the engine must add
+// `runner` (an account's name) to its declaration's Identity, and put that account in the group mesh-<module>.
+const OwnGroupContract = 7
+
 // KindLibrary is a library's own verdict on its home, as the engine may state it (novox/hq ADR 0328): healthy once
 // kept. Read beside an access verdict naming the library until the engine's shape is settled.
 const KindLibrary = "library"