Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition

The third review of #170 (hq issue 339): a setting overrides any key a
provider serves, so any caller of the settings verb could move a database's
port, a registry's port or an issuer to a listener of its own and collect
what consumers present. TerminalKeys now derives from the manifest: places,
accesses, every served key and every setting a served value asks for, and
every setting a file marked `trusted` asks for. `trusted` is the catalogue's
word, taken out before the declaration; `module check` warns of a file that
asks for a setting without saying, and refuses it from 2026-10-30. The hand
list is gone. A directory used as found is now its own condition kind, the
operator's, never urgent, and the gate exempts it where it exempts a relogin.

cmd/mesh-controller/modules.go

@@ -445,7 +445,7 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		if err := refuseTerminalSettingsThroughAVerb(before, values, positionals[0], where); err != nil {
+		if err := refuseTerminalSettingsThroughAVerb(ctx, inv, before, values, positionals[0], where); err != nil {
 			return err
 		}
 		added, changed, removed := settingsChange(before, values)
@@ -603,7 +603,7 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		if err := refuseTerminalSettingsThroughAVerb(before, nil, positionals[0], where); err != nil {
+		if err := refuseTerminalSettingsThroughAVerb(ctx, inv, before, nil, positionals[0], where); err != nil {
 			return err
 		}
 		if err := inv.ClearSettings(ctx, *node, positionals[0]); err != nil {
@@ -998,6 +998,9 @@ func whereItComesFrom(repository, ref, commit, path string, self bool) (inventor
 // definition that got past the check — written elsewhere, or checked by nobody — is refused here
 // in the same words. A name meant on purpose is declared with its reason and passes.
 func namesNoInstallation(m catalogue.Manifest) error {
+	if problems := catalogue.TrustProblems(m); len(problems) > 0 {
+		return fmt.Errorf("%s", strings.Join(problems, "; "))
+	}
 	named := catalogue.InstallationProblems(m)
 	if len(named) == 0 {
 		return nil
@@ -1080,12 +1083,19 @@ func throughAVerb() (string, bool) {
 
 // refuseTerminalSettingsThroughAVerb refuses a layer change through a verb that would add, change or remove
 // places or accesses; a change that leaves both as they were is not refused.
-func refuseTerminalSettingsThroughAVerb(before, after map[string]any, module, where string) error {
+func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inventory, before, after map[string]any,
+	module, where string) error {
 	verb, through := throughAVerb()
 	if !through {
 		return nil
 	}
-	for _, key := range catalogue.TerminalKeys(module) {
+	// Judged against the module's definition as the catalogue holds it: what it serves and which of its files
+	// are trusted. A catalogue that cannot be read refuses rather than judging against nothing.
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		return fmt.Errorf("which settings of %s are the terminal's cannot be read, so nothing was changed: %w", module, err)
+	}
+	for _, key := range catalogue.TerminalKeys(shelf[module]) {
 		was, _ := json.Marshal(before[key])
 		now, _ := json.Marshal(after[key])
 		if string(was) == string(now) {