Answer mesh-cli: the control-node's operator is the terminal, everyone else is not (hq ADR 0272)

The records send the operator to "the controller's terminal", and nothing
reached it (hq issue 343). The serving controller now answers each node's
mesh.control.<node>.cli, where only that node's engine may publish, with the
account the engine read from the kernel. A line from the control-node's
operator account runs as the terminal: a fresh process of this binary with
no MESH_VERB, whatever the serving process carries. The same account on any
other node, where agents may run as it, is an ordinary call: the generic
command verb's refusals (one function now, so the two routes cannot drift)
and MESH_VERB=mesh-cli, so a terminal-only change is refused with its
reason. Any other account, root included, runs nothing. Servers are never
run, and an answer over one bus message is cut and says so.

The terminal-only refusals and the usage now name mesh-cli on the
control-node as the way to the terminal.

cmd/mesh-controller/modules.go

@@ -1107,7 +1107,7 @@ func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inve
 	}
 	// A trusted mergeable file takes any key, so its module's whole layer is the terminal's (novox/hq issue 340).
 	if files := catalogue.TrustedMergeable(shelf[module]); len(files) > 0 && !sameLayer(before, after) {
-		return fmt.Errorf("the settings of %s on %s are set at the controller's terminal only, never through a verb (this "+
+		return fmt.Errorf("the settings of %s on %s are set at the controller's terminal only (`mesh-cli` on the control-node), never through a verb (this "+
 			"line came through %q): %s merges whatever key a layer sets into a file root or a consumer trusts, so "+
 			"any key could point the module at a listener of the caller's, and whoever may call a verb includes "+
 			"agents (novox/hq issue 340; a file nothing trusts says \"trusted\": false). Nothing was changed",
@@ -1119,7 +1119,7 @@ func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inve
 		if string(was) == string(now) {
 			continue
 		}
-		return fmt.Errorf("%s of %s on %s is set at the controller's terminal only, never through a verb (this "+
+		return fmt.Errorf("%s of %s on %s is set at the controller's terminal only (`mesh-cli` on the control-node), never through a verb (this "+
 			"line came through %q): it says where root creates and owns a module's directories, which of "+
 			"the machine's paths are mounted into its container, what the mesh's consumers trust, or what a file "+
 			"root or a person's session obeys takes, and whoever may call a verb includes agents (novox/hq issue 339; "+