Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

A secrets object with one local name delivered no file. Two requirements could share
a local name. secret recover and the export could not tell two locals apart. The
recipe check missed continued lines and read heredoc bodies as bases. repo:tag@digest
kept the tag in the repository. ask now publishes mandatory, so a tool nothing serves
is said at once rather than after the wait.

internal/catalogue/several_secrets_test.go

@@ -159,3 +159,47 @@ func TestAProviderKeepsOneFilePerHolder(t *testing.T) {
 		t.Fatalf("two holders are two grant files: %v", ids)
 	}
 }
+
+// One file under a local name is still a local name (review C1): the need carries it, the file
+// is written, and ${secret:<name>} is filled.
+func TestOneLocalNameIsStillALocalName(t *testing.T) {
+	only, _ := ParseManifest([]byte(`{"module":"one","version":"1","requires":["secret"],
+	  "secrets":{"secret":{"only":"/var/lib/one/only"}}}`))
+	vault := vaultAndCA()["mesh-vault"]
+	got, err := Resolve(shelf(vault, only), []string{"mesh-vault", "one"}, workstation(), World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var found *Needed
+	for i, n := range got.Needs {
+		if n.For == "one" && n.Name == "secret" {
+			found = &got.Needs[i]
+		}
+	}
+	if found == nil || found.Local != "only" {
+		t.Fatalf("the one named file did not become a need under its name: %v", got.Needs)
+	}
+	found.Sealed = "sealed-only"
+	out, err := got.Declaration(Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var written bool
+	for _, r := range out {
+		if r["path"] == "/var/lib/one/only" && r["sealed"] == "sealed-only" {
+			written = true
+		}
+	}
+	if !written {
+		t.Fatal("the file under the one local name was not written")
+	}
+}
+
+// A local name names one credential: two requirements may not share it (review C2).
+func TestALocalNameIsUniqueAcrossRequirements(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"x","version":"1","requires":["secret","postgres-database"],
+	  "secrets":{"secret":{"x":"/var/lib/x/a"},"postgres-database":{"x":"/var/lib/x/b"}}}`))
+	if err == nil || !strings.Contains(err.Error(), "both under") {
+		t.Fatalf("two requirements under one local name were accepted: %v", err)
+	}
+}