catalogue: a contribution reaches the port its own machine published, from any machine

The co-located fix could not reach a grant assembled for a consumer on another
machine: ContributionsFrom never sees a port map, so the proxy was told the
workload's software port and dialled a number that machine never published. The
consumer's own assignments are fetched where the grant is built and applied
there. The same fault as 038, one node over.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

internal/catalogue/declaration.go

@@ -997,3 +997,15 @@ func atMachinePort(serves map[string]any, module string, ports map[string]map[in
 	copied["port"] = at
 	return copied
 }
+
+// AtPublishedPort redirects a contribution's port to where the CONSUMER's own machine published it.
+//
+// The same redirection as [atMachinePort], for the one caller that cannot reach it. A grant is
+// assembled on the providing machine out of a consumer that lives on another one, so that
+// consumer's assignments are fetched there and handed in, rather than looked for here where they
+// are not. Without it a proxy told to reach a workload on another machine is told the port the
+// workload's *software* uses, and dials a number that machine never published — the same fault as
+// novox/hq 04-ISSUES/038, one node over.
+func AtPublishedPort(values map[string]any, module string, published map[int]int) map[string]any {
+	return atMachinePort(values, module, map[string]map[int]int{module: published})
+}