Count the login shell where its execute is served, not where its seat is held (hq ADR 0268)

The control-node withholds execute through its holder's setting since ADR 0268, so probe D-root read a
closed path as open. It now counts the verb as served while the holder's setting for that machine is
serve, or the bus hears execute answered there, or the bus could not be asked: a withheld value not yet
pushed, or a holder answering against its setting, is never taken for closed.

cmd/mesh-controller/probe_agent_root_test.go

@@ -58,3 +58,45 @@ func TestTheRootConditionIsSaidInPlainWords(t *testing.T) {
 		t.Errorf("not plain: %s", why)
 	}
 }
+
+// novox/hq ADR 0268: the login shell counts only where its execute is served, and fails closed — the holder's
+// setting resolving to anything but serve and the bus hearing no execute there is the one way it is withheld.
+func TestTheLoginShellCountsOnlyWhereExecuteIsServed(t *testing.T) {
+	val := func(v any) *any { return &v }
+	cases := []struct {
+		name          string
+		claims        bool
+		setting       *any
+		heard, asked  bool
+		served        bool
+		saysInTheWhys string
+	}{
+		{"withheld by the setting and silent on the bus", true, val("withhold"), false, true, false, ""},
+		{"withheld by the setting, the machine not yet pushed", true, val("withhold"), true, true, true, "the bus hears"},
+		{"the setting serves", true, val("serve"), false, true, true, "setting there is serve"},
+		{"a wrong value withholds, as the holder does", true, val("Serve"), false, true, false, ""},
+		{"the setting withholds, the bus could not be asked", true, val("withhold"), false, false, true, "could not be asked"},
+		{"a holder with no such setting that claims execute", true, nil, false, true, true, "claims execute"},
+		{"a holder with no such setting that does not claim it, heard all the same", false, nil, true, true, true, "the bus hears"},
+		{"a holder with no such setting that does not claim it, silent", false, nil, false, true, false, ""},
+	}
+	for _, c := range cases {
+		served, why := loginShellServed("zsh", c.claims, c.setting, c.heard, c.asked)
+		if served != c.served || (c.saysInTheWhys != "" && !strings.Contains(why, c.saysInTheWhys)) {
+			t.Errorf("%s: served %v (%q), want %v saying %q", c.name, served, why, c.served, c.saysInTheWhys)
+		}
+	}
+
+	// The control-node with execute withheld and agents of their own account: nothing is said.
+	f := agentRootFacts{Machine: "anchor", Trusted: []string{"telegram"}, Runtime: "ops", Agent: "agents", AgentNamed: true,
+		Answers: map[string]escalation{"ops": {Root: true, Why: "NOPASSWD"}, "agents": {Why: "none"}}}
+	f.LoginShell, f.LoginShellWhy = loginShellServed("zsh", true, val("withhold"), false, true)
+	if got := agentRootObservations(f); len(got) != 0 {
+		t.Errorf("execute withheld and agents confined: %+v", got)
+	}
+	// Withheld in the setting, still answered on the bus: said, with why.
+	f.LoginShell, f.LoginShellWhy = loginShellServed("zsh", true, val("withhold"), true, true)
+	if got := agentRootObservations(f); len(got) != 1 || !strings.Contains(got[0].Summary, "the bus hears execute answered there") {
+		t.Errorf("execute still answered: %+v", got)
+	}
+}