Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

A module could say nothing about what ready means for what it runs, so a web
application with its port open and its requests hanging passed everything for
eleven hours (issue 145). A long-running resource now carries `health` — the
image's own check adopted by name, http, tcp, exec, unit or a module's own tool,
with its timing — refused near its author when it names a port or an address,
an endpoint the module does not declare, a tool it does not serve, a tool check
alone, or a timing outside the record's bounds. It is composed with the endpoint
as the port this machine published it on, and sent only to a node-engine whose
statement says it reads it: an older one would refuse the whole declaration.
The engine is granted its own machine's instance of each health tool. `module
check` warns of every long-running resource without `health`, counts them for
the catalogue, and refuses them from 2026-11-18. A check's findings stay out of
a condition's summary. The node-engine's validator is vendored at its Phase B
commit, so what is composed is judged by the words the engine takes.

internal/broker/users.go

@@ -44,6 +44,9 @@ type Declared struct {
 	// SnapshotsTheBus says the module holds mesh-broker — it is the bus — and so is the one module
 	// granted the snapshot API, to copy the bus's streams for the night's backup (novox/hq ADR 0235).
 	SnapshotsTheBus bool
+	// Checks are the module's own tools its health asks, each `<module>.<tool>` (novox/hq ADR 0240, to-be
+	// 48 §3): the machine's node-engine asks them of its own node tools, and is granted that and no more.
+	Checks []string
 }
 
 // Records is what composing a user list needs to know about the mesh, and nothing more.
@@ -73,12 +76,14 @@ func Users(r Records) ([]Principal, error) {
 
 	for _, node := range sortedCopy(r.Nodes) {
 		witness := false
+		var checks []string
 		for _, d := range r.Assigned[node] {
 			if d.Module == controllerModule {
 				witness = true
 			}
+			checks = append(checks, d.Checks...)
 		}
-		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness})
+		out = append(out, Principal{Kind: KindNode, Node: node, WitnessesController: witness, Checks: checks})
 		// **Where the runtime is assigned, the machine gets one runtime principal in place of the
 		// runtime module's own** (novox/hq ADR 0175, to-be 38). It carries every module on the
 		// node: its serving grants are the union of theirs. Every other module keeps its own