Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

A secrets object with one local name delivered no file. Two requirements could share
a local name. secret recover and the export could not tell two locals apart. The
recipe check missed continued lines and read heredoc bodies as bases. repo:tag@digest
kept the tag in the repository. ask now publishes mandatory, so a tool nothing serves
is said at once rather than after the wait.

cmd/mesh-controller/secret.go

@@ -123,6 +123,7 @@ func secretRecover(ctx context.Context, args []string) error {
 	out := set.String("out", "", "where to write the value (0600); - for standard output. Default <node>.<module>.<name>.secret")
 	fromExport := set.String("from-export", "", "read the sealed copy from this `secret export` file instead of the store")
 	provider := set.String("provider", "", "for a pair credential held from more than one provider: which one")
+	local := set.String("local", "", "for a pair credential the module keeps under a local name (ADR 0094): which one")
 	if err := set.Parse(flags); err != nil {
 		return err
 	}
@@ -147,7 +148,7 @@ func secretRecover(ctx context.Context, args []string) error {
 			return err
 		}
 		defer open.Close()
-		kept, err = open.inventory.KeptSecret(ctx, node, module, name, *provider)
+		kept, err = open.inventory.KeptSecret(ctx, node, module, name, *provider, *local)
 		if err != nil {
 			return err
 		}