Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

A secrets object with one local name delivered no file. Two requirements could share
a local name. secret recover and the export could not tell two locals apart. The
recipe check missed continued lines and read heredoc bodies as bases. repo:tag@digest
kept the tag in the repository. ask now publishes mandatory, so a tool nothing serves
is said at once rather than after the wait.

internal/catalogue/resolve.go

@@ -881,7 +881,9 @@ func perConsumer(needs []Needed, order []string, catalogue map[string]Manifest)
 // from one provider (ADR 0094). Each is its own pair credential downstream.
 func eachLocal(needs []Needed, catalogue map[string]Manifest, n Needed) []Needed {
 	files := catalogue[n.For].SecretFiles(n.Name)
-	if len(files) <= 1 {
+	// One file under a local name is still a local name: the review found a module keeping ONE
+	// named secret given a need with no local, and so no file, while everything reported success.
+	if len(files) == 0 || (len(files) == 1 && files[0].Local == "") {
 		return append(needs, n)
 	}
 	for _, f := range files {