identity: a consumer's identity fits the tightest backend, via a slug (ADR 0054)

A module may declare a short `slug`; the mesh derives mesh_<node>_<slug|name> and
refuses at assignment (naming the slug as the remedy) when it would still overflow —
identityLimit is now 20, an S3 access key's, the tightest of the backends a login
reaches (04-ISSUES/010). The slug rides the grant so the provider derives the same
login the consumer does, even across nodes. CheckIdentity is now wired, in grantsFor.

Also, the minted secret shrinks to 40 chars (30 bytes) from 43: an S3 secret key is
8-40, the same fit-the-tightest-backend rule on the credential's other half.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

cmd/mesh-control/plan.go

@@ -520,9 +520,25 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 			// working for ever after its consumer went away.
 			from = ""
 		}
+		// The consumer's identity slug, from its own manifest, carried on the grant so the provider
+		// derives the same login the consumer does (novox/hq ADR 0054). Refused here if it still would
+		// not fit the tightest backend — the mesh chose the name, so the mesh refuses it, with the
+		// remedy a short slug rather than a login a provider silently shortened.
+		slug := ""
+		for _, mm := range plan.Modules {
+			if mm.Module == s.ConsumerModule {
+				slug = mm.Slug
+				break
+			}
+		}
+		if from != "" {
+			if err := catalogue.CheckIdentity(s.Consumer, catalogue.IdentitySource(slug, s.ConsumerModule)); err != nil {
+				return nil, err
+			}
+		}
 		out = append(out, catalogue.Grant{
 			Provision: s.Name, Consumer: s.Consumer, At: onNetwork[s.Consumer],
-			From: from, Values: values, Sealed: s.ForProvider})
+			From: from, Values: values, Slug: slug, Sealed: s.ForProvider})
 	}
 	return out, nil
 }