Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions,
hands bus accounts to the vault and judges the new manifest words, on the
feature's SDK and node-engine validator (feature 57, config and provisioning).

internal/link/protocol.go

@@ -448,6 +448,35 @@ const RootContract = 3
 // mesh-host internal/link/messages.go's BusyContract.
 const BusyContract = 8
 
+// OwnershipContract is the statement of an engine that also reads a file's `owner-at-runtime` and a declaration's
+// `filled_files` (novox/hq ADR 0349 §5). The same number as mesh-host internal/link/messages.go's.
+const OwnershipContract = 9
+
+// ProvisionerContract is the statement of an engine that also reads a declaration's `provisioner_account` and
+// serves the local write socket a provisioner client fills through (novox/hq ADR 0349 §4). The same number as
+// mesh-host internal/link/messages.go's.
+const ProvisionerContract = 10
+
+// HandedContract is the statement of an engine that writes a filled file only on the provisioner client's word
+// and no longer from the declaration (novox/hq ADR 0349 §5, design 57 P7, issue 673): one writer per placed file.
+// A moved module is handed to the provisioner only on a machine whose engine states this or later (design 57 P6);
+// to an engine at OwnershipContract or ProvisionerContract a filled file would have two writers — the client, and
+// the engine applying the declaration's file without its text — so such a machine is sent the module as before.
+// mesh-host states it with P7.
+const HandedContract = 11
+
+// VaultBoxContract is the statement of an engine that also reads a file's `vault-sealed` (novox/hq ADR 0349 §16, issue
+// 755): a core module's own credential the vault sealed to its machine in the mesh's sealed box, which the controller
+// carries and cannot open, opened by the engine with its sealing key. Only to such an engine is the vault's box sent;
+// an engine below it parses strictly and would refuse the whole declaration for the field, and is sent the
+// controller's own sealed value as before. The same number as mesh-host internal/link/messages.go's.
+const VaultBoxContract = 12
+
+// NodeKeyContract is the statement of an engine that states its own sealing key to the vault, in its own name, at its
+// start and whenever the key changes (novox/hq ADR 0372, issue 786). The same number as mesh-host
+// internal/link/messages.go's.
+const NodeKeyContract = 13
+
 // The states of a busy container in a report (novox/hq ADR 0335 §2, §3).
 const (
 	BusyWaiting         = "waiting"