catalogue: a module accesses operator-owned data, and does not own it

04-ISSUES/036: the media stack is several modules that must share the
library and download directories on one machine, but the manifest could
only say "a directory I own". Six modules each declared the same paths as
their own resources, and the resolver's duplicate-owner refusal — right
in general — would refuse the stack's only sensible assignment the first
time two of them landed on one node.

Add an `accesses` field: a pre-existing, operator-owned path a module is
granted use of but does not own (novox/hq ADR 0051). Distinct from a
`directory` resource on every axis the host acts on — the mesh creates,
chowns and reconciles a directory; it mounts an access and owns nothing.
An access is not a resource, so it never enters the duplicate-owner map
and several modules may name one path with no conflict. What is refused
is the contradiction: a path one module owns and another accesses.

Rendered into the declaration as an `access` resource, before the
container that mounts it, so the host can find it present or refuse
clearly. Unit tests cover co-resolution (the exact 036 case), the
unchanged owner-vs-owner refusal, the owner-vs-accessor refusal, and
access validation.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

internal/catalogue/declaration.go

@@ -215,6 +215,16 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 				"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name], "sealed": sealed,
 			})
 		}
+		// Operator-owned paths this module is granted use of (novox/hq ADR 0051). Written before
+		// the module's own resources, and so before the container that mounts them: the host must
+		// find each present — refusing clearly if the operator has not provided it — before it
+		// starts anything that depends on it. The mesh creates, chowns and reconciles none of it;
+		// an `access` resource says only *this path must exist, and this module reaches it*.
+		for _, a := range m.Accesses {
+			first = append(first, map[string]any{
+				"id": AccessID(a.Path), "type": "access", "path": a.Path, "mode": a.At(),
+			})
+		}
 		for _, to := range sortedKeys(m.Secrets) {
 			var found *Needed
 			for i, n := range r.Needs {