give: take only a value a person holds, ask the desk by name, let the controller alone ask it, and announce every value given

The review of 2026-10-09 (M4):
- give refuses broker (the bus account issue mints) and any own secret the mesh may make itself;
- the desk's prompt is asked by module, secret and machine, never with words of the caller's, and the
  bus denies the prompt's subjects to every principal but the controller, however wide its grant, so the
  prompt's 'the controller asks' is the bus's word (Permissions.PublishDeny, broker.ControllerOnly);
- secret accept with a value is refused through a verb: a value comes from the terminal or the desk;
- every value given for an own secret, at the terminal or the desk, raises the urgent condition
  secret-given on every channel, until the operator silences it.

cmd/mesh-controller/secret.go

@@ -68,6 +68,12 @@ func secretCommand(ctx context.Context, args []string) error {
 		return errors.New(secretUsage)
 	}
 	node, module, name := rest[0], rest[1], rest[2]
+	// A value comes from the terminal or the desk, never through a verb (the review of 2026-10-09, M4): a
+	// verb's caller may be an agent, and a value it chose would become what a module acts with.
+	if verb, through := throughAVerb(); through && *desk == "" {
+		return fmt.Errorf("a secret's value is given at the controller's terminal or at the desk (`give`), never "+
+			"through a verb (this line came through %q): nothing was read or sealed", verb)
+	}
 	if *desk != "" {
 		if *from != "" || *provider != "" {
 			return errors.New("--at-desk gives a module's own secret, and takes neither --from nor --provider")
@@ -106,6 +112,9 @@ func secretCommand(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
+	if err := announceSecretGiven(ctx, node, module, name, "at the controller's terminal"); err != nil {
+		fmt.Printf("  this change could NOT be announced on the operator's channels: %v\n", err)
+	}
 	// Not printed back, and there is nowhere it could be printed from: it is sealed to that
 	// machine and the mesh cannot read it again.
 	fmt.Printf("%s on %s now holds %q, sealed to that machine.\n", module, node, name)