The restart-on rename reads both list shapes

A resource composed in code carries restart-on as []string; the rename
only read []any, so the overlay's registry-trust reload kept its bare
reference, pointed at nothing, and the runtime was never restarted —
the trust was on disk and not in the daemon, with every check passing.
Diagnosed on the built-store-cross-node bed, run 8 (issues 042/048).

internal/catalogue/reflects_renamed_test.go

@@ -0,0 +1,32 @@
+package catalogue
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestReflectsRenamedReadsBothShapes(t *testing.T) {
+	// The list arrives as []any when the resource was parsed from JSON, and as []string when it
+	// was composed in code — the overlay's registry trust is the second kind. A shape that was
+	// skipped would leave the reference unprefixed, pointing at nothing, and the service would
+	// never restart while every check passed (novox/hq issues 042/048, the run-8 diagnosis).
+	parsed := reflectsRenamed("mesh-wireguard", []any{"registry-trust"})
+	if !reflect.DeepEqual(parsed, []any{"mesh-wireguard.registry-trust"}) {
+		t.Fatalf("parsed shape: %v", parsed)
+	}
+	composed := reflectsRenamed("mesh-wireguard", []string{"registry-trust"})
+	if !reflect.DeepEqual(composed, []any{"mesh-wireguard.registry-trust"}) {
+		t.Fatalf("composed shape: %v", composed)
+	}
+
+	// A name already under a module keeps it: that is how a service reflects a file another
+	// module put on the machine.
+	kept := reflectsRenamed("resolver", []string{"mesh-wireguard.fact-node-names", "own-config"})
+	if !reflect.DeepEqual(kept, []any{"mesh-wireguard.fact-node-names", "resolver.own-config"}) {
+		t.Fatalf("dotted name was not kept: %v", kept)
+	}
+
+	if got := reflectsRenamed("any", nil); got != nil {
+		t.Fatalf("no list should rename to nothing, got %v", got)
+	}
+}