Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions,
hands bus accounts to the vault and judges the new manifest words, on the
feature's SDK and node-engine validator (feature 57, config and provisioning).

internal/inventory/secrets.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
+	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/secrets"
 )
@@ -595,6 +596,26 @@ func (i *Inventory) DeclaresOwnSecret(ctx context.Context, module, name string)
 	return GivableAtDesk(m, name)
 }
 
+// OwnSecretPrompt is the one line the desk asks for this secret as — the module's declared `prompt`, read from
+// the controller's own catalogue, never from the call or the module's runtime (novox/hq issue 789). For a family
+// member it is the family's prompt with `{member}` replaced by the member's suffix. Empty when the module or the
+// secret is unknown, or declares no prompt — the desk then asks by name alone, as it does today.
+func (i *Inventory) OwnSecretPrompt(ctx context.Context, module, name string) (string, error) {
+	m, err := i.declared(ctx, module)
+	if err != nil {
+		return "", err
+	}
+	own, family, ok := m.OwnSecrets.Lookup(name)
+	if !ok || own.Prompt == "" {
+		return "", nil
+	}
+	if family == "" {
+		return own.Prompt, nil
+	}
+	member := strings.TrimPrefix(name, catalogue.FamilyPrefix(family))
+	return strings.ReplaceAll(own.Prompt, "{member}", member), nil
+}
+
 // RunsAsItsOwnAccount says a module runs as an account of its own (novox/hq ADR 0259 §8): a trusted party — the
 // router, a channel that proves its sender or shows a link's code — whose own secret is what the operator's
 // answers are believed by. Its value is given at the controller's terminal alone.
@@ -619,7 +640,7 @@ func GivableAtDesk(m catalogue.Manifest, name string) error {
 		return fmt.Errorf("%s does not declare %q as an own secret; %s", m.Module, name, declaresOwn(m))
 	}
 	switch {
-	case name == BrokerSecret:
+	case name == BrokerSecret || name == broker.ProvisionerSecret:
 		return fmt.Errorf("%q is %s's account on the bus, which the mesh makes (`issue`), never a value a person gives",
 			name, m.Module)
 	case own.MeshMayMake():