Judge every manifest against the list of predefined keys of its tree, and carry the list from a build

Mesh and node config may hold values only for keys on a fixed, reviewed list (hq ADR 0348 clause 7, design 57 package K2, issue 661). A build reads predefined.json at the root of the repository at the commit it builds and carries it with the commit's generation; module check and the merge gate read it from the tree. (Part 1 of 2: the changes to existing files.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/catalogue/config_test.go

@@ -157,20 +157,20 @@ func TestConfigRefusesAnObjectOrListNotTrusted(t *testing.T) {
 	}
 }
 
-// withPredefined is the list of predefined keys as package K2 will give it, for the length of a test.
-func withPredefined(t *testing.T, keys map[string]PredefinedKey) {
+// withPredefined is the list of predefined keys the mesh published, for the length of a test.
+func withPredefined(t *testing.T, keys PredefinedList) {
 	t.Helper()
-	was := predefinedKeys
-	predefinedKeys = keys
-	t.Cleanup(func() { predefinedKeys = was })
+	was := ReplacePublished(keys)
+	t.Cleanup(func() { ReplacePublished(was) })
 }
 
-// Rule 5: a predefined key not on the list, or of another type. Until the list is present (package K2), a value
-// naming one is refused saying so.
+// Rule 5: a predefined key not on the list, or of another type. Where no list is present, a value naming one is
+// refused saying so.
 func TestConfigRefusesAPredefinedKeyNotOnTheListOrOfAnotherType(t *testing.T) {
+	withPredefined(t, nil)
 	m := inConfigForm()
 	declaration(m, "font-size")["predefined"] = "font-size"
-	refused(t, m, `"font-size"`, "the list of predefined keys", "not yet present")
+	refused(t, m, `"font-size"`, "the list of predefined keys", "is not present")
 
 	withPredefined(t, map[string]PredefinedKey{"font-size": {Type: "number"}, "accent": {Type: "string"}})
 	if _, err := parseRaw(t, m); err != nil {
@@ -186,9 +186,10 @@ func TestConfigRefusesAPredefinedKeyNotOnTheListOrOfAnotherType(t *testing.T) {
 
 // Rule 6: an untrusted value falling back to a trusted predefined key.
 func TestConfigRefusesAnUntrustedValueFallingBackToATrustedKey(t *testing.T) {
+	withPredefined(t, nil)
 	m := inConfigForm()
 	declaration(m, "theme")["predefined"] = "theme"
-	refused(t, m, `"theme"`, "not yet present")
+	refused(t, m, `"theme"`, "is not present")
 
 	withPredefined(t, map[string]PredefinedKey{"theme": {Type: "string", Trusted: true}})
 	refused(t, m, `"theme"`, "trusted", "is not")