Review round 1: a carried module's queue consumer survives PruneHeard, a work-queue stream's restricted metadata is proven on the server config (issue 1178)

ConsumersOf's carried-module path (a module the tool runner carries, no
account of its own — mesh-mail's real shape) was not passing Queues
through, so its work-queue consumer was missing from the composed list
and PruneHeard would have removed what issueProcess made for it. Fixed,
with a test through Users -> ConsumersOf.

Extracted EnsureStream's config building into StreamConfigFor, a pure
function, so the dead-letters test can assert the restricted metadata
EnsureStream would actually send for a work-queue stream instead of
setting the dead letter's header by hand, which passed whether or not
modstreams.go's out.Restricted = true was there at all.

internal/link/deadletters_work_queue_test.go

@@ -6,12 +6,31 @@ import (
 	"time"
 
 	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
 )
 
 // A work-queue stream's dead letters are kept and shown as a restricted stream's are — aged with the
 // stream, never with their body or headers — and can only be dropped, never delivered again (novox/hq ADR
 // 0436 §6, changing ADR 0363 §7 for such a stream).
 
+// review round 1, finding 6 (1178/AC3): a work-queue stream really is restricted on the bus — its own
+// Stream() says so, and that is what EnsureStream's config sets the metadata from (jetstream.go's
+// streamConfigFor) — not merely a header this test set by hand, which would still pass with
+// modstreams.go's `out.Restricted = true` removed.
+func TestAWorkQueueStreamIsRestrictedOnTheBus(t *testing.T) {
+	mailSends := broker.ModuleStream{Module: "mesh-mail", Name: "MAIL_SENDS", Events: []string{"mail.send.approved"},
+		MaxAgeDays: 1, MaxMiB: 8, WorkQueue: true, Duplicates: 1}
+	stream := mailSends.Stream()
+	if !stream.Restricted {
+		t.Fatalf("a work-queue stream's own Stream() is not restricted: %+v", stream)
+	}
+	cfg := broker.StreamConfigFor(stream)
+	if cfg.Metadata[broker.RestrictedMetadata] != "true" {
+		t.Fatalf("the server config EnsureStream would send does not carry the restricted metadata: %+v", cfg.Metadata)
+	}
+}
+
 // 1178/AC3: a dead letter's headers say it came from a work-queue stream, and reading it back carries that
 // (and the restricted flag its aging and hiding already key off, deadLetterOf being the one place both are
 // read: see DeadLetter.Restricted's doc).