Issue the provisioner client its own account when its module declares no broker

The catalogue's mesh-provisioner-client declares only provisioner-broker:
the client speaks on the bus as itself. module issue refused it for
lacking a broker, assign minted nothing, and push refused it for lacking
an account, so no machine could run the client (issue 917).

cmd/mesh-controller/acts.go

@@ -391,10 +391,10 @@ func blockedElsewhere(ctx context.Context, open *stores, except string) string {
 }
 
 // issueOnAssign gives a newly assigned module its bus credential, the way `module issue` does, and
-// says what it did in one line. Nothing for a module that declares no broker secret; nothing for one
-// whose user is already minted (a credential is rotated on purpose, never by re-assigning); and when
-// the bus cannot be reached from here, the line names the verb and the push that would refuse the
-// module until it is run — never a silent placeholder (novox/hq issue 203).
+// says what it did in one line. Nothing for a module that declares no broker secret and runs no
+// provisioner client; nothing for one whose user is already minted (a credential is rotated on
+// purpose, never by re-assigning); and when the bus cannot be reached from here, the line names the
+// verb and the push that would refuse the module until it is run — never a silent placeholder (novox/hq issue 203).
 func issueOnAssign(ctx context.Context, open *stores, node, module string) string {
 	inv := open.inventory
 	shelf, err := inv.Catalogue(ctx)
@@ -406,6 +406,10 @@ func issueOnAssign(ctx context.Context, open *stores, node, module string) strin
 		return ""
 	}
 	user := broker.Principal{Kind: broker.KindModule, Node: node, Module: module}.Username()
+	if _, reads := m.OwnSecrets["broker"]; !reads {
+		// A module running the provisioner client alone is minted the client's account (issue 917).
+		user = broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: module}.Username()
+	}
 	if _, minted, err := inv.BusUserHash(ctx, user); err != nil || minted {
 		return ""
 	}