A provider with one credential shares it with every consumer, remade for all at once (hq ADR 0158)

An offer may say `"credential": {"own": "<secret>"}`: the provider's own secret is the credential
every consumer of that provision receives, in the shape of a pair credential. The vault keeps one
value, sealed to the provider, to every consumer that holds the provision and to the operator, all
under one generation stamp; a consumer binding later, or `secret rotate` on the provider's secret,
makes a fresh value and seals it to every holder in one act, and the rotate command sends every
holding machine together. An accepted value is sealed to the consumers of the moment and never
remade: a consumer binding after it is refused with the way out (ADR 0113). The named own secret
must say how it is taken (issue 180), so the provider's start applies the file.

A need carries the shared secret's name from either side of the machine boundary; the plan mints a
consumer's copy from the provider's value. Registered manifests keep their bytes.

internal/catalogue/resolve.go

@@ -179,6 +179,10 @@ type Needed struct {
 	// for one requirement (ADR 0094); empty for the ordinary one. Part of what identifies the pair
 	// credential, so two secrets from one provider to one module are two secrets.
 	Local string
+	// SharedOwn is set when the provision's credential is one of the provider's own secrets, shared
+	// by every consumer (novox/hq ADR 0158): the name of that secret in the provider's definition.
+	// The plan mints the pair's copy from the provider's value rather than a value of its own.
+	SharedOwn string
 	// Manager is set when this holder is a refreshable-grant licence's MANAGER, delivered the refresh
 	// token rather than an access token (novox/hq ADR 0050). It changes one thing downstream: an empty
 	// Sealed is tolerated — the manager has not adopted a refresh token yet, which is a real waiting
@@ -322,7 +326,8 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 				}
 				needs = append(needs, Needed{
 					Name: want, From: node.Name, At: at,
-					Serves: servedHere(catalogue, chosen, want), For: because[want]})
+					Serves: servedHere(catalogue, chosen, want), For: because[want],
+					SharedOwn: sharedHere(catalogue, chosen, want)})
 			} else if served := servedHere(catalogue, chosen, want); len(served) > 0 {
 				// Answered here with no credential to mint, but the provider serves facts the
 				// consumer cannot guess — a port, a model name — and so still needs a binding.
@@ -369,8 +374,12 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 						node.Name, want, p.Node, meshNetwork))
 					return
 				}
+				shared := ""
+				if pm, known := catalogue[p.Module]; known {
+					shared, _ = pm.SharedCredentialOf(want)
+				}
 				needs = append(needs, Needed{Name: want, From: p.Node, At: p.At,
-					Serves: p.Serves, For: because[want]})
+					Serves: p.Serves, For: because[want], SharedOwn: shared})
 			}
 			switch {
 			case world.Unchecked:
@@ -588,6 +597,20 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 // need that is never created is a binding the consumer never gets. It is right about that from the
 // manifest alone, which is why walking the catalogue mid-resolution is enough here and is not
 // enough for the values.
+// sharedHere is the own secret the provider of a provision on this same machine names as its
+// credential (ADR 0158), or "" when the provider gives each consumer its own.
+func sharedHere(catalogue map[string]Manifest, chosen map[string]bool, want string) string {
+	for name, m := range catalogue {
+		if !chosen[name] {
+			continue
+		}
+		if own, shared := m.SharedCredentialOf(want); shared {
+			return own
+		}
+	}
+	return ""
+}
+
 func servedHere(catalogue map[string]Manifest, chosen map[string]bool, want string) map[string]any {
 	for name, m := range catalogue {
 		if !chosen[name] {