Name the paths a seat's holder owns, and refuse a claim or a declaration without the seat (issue 412)

Which module owns /etc/hosts or /etc/resolv.conf on a machine was answered only by reading every
manifest, and a module not holding node-hostname could declare /etc/hosts where nobody held it.
hq ADR 0287 makes the paths part of the seat's definition: node-hostname names /etc/hosts and
/etc/hostname, node-uplink names /etc/resolv.conf stepping back for node-resolver, node-resolver
names /etc/resolv.conf.

CanHold refuses a holder that does not declare every path (registration and handover), registration
refuses a module declaring a seat's path while claiming none of the seats naming it, a module's own
seat names paths under the same rules (node only, literal, not named by another seat), composition
refuses a generated resource on a seat's path, the uplink's step-back is read from the seat instead
of a special case, and `seats` shows each seat's paths and who owns each on each machine.

internal/catalogue/declaration.go

@@ -2579,5 +2579,11 @@ func (r Resolution) generatedHere(with Rendering) (map[string][]map[string]any,
 		return nil, fmt.Errorf("what the mesh computes for this machine collides with a module's own: %s",
 			strings.Join(problems, "; "))
 	}
+	// **Nor does the controller write a seat's path** (novox/hq ADR 0287): what it generates is held to the
+	// rule a manifest is held to at registration — only a module claiming a seat that names a path declares it.
+	if problems := generatedOnSeatPaths(r.Modules, generated); len(problems) > 0 {
+		return nil, fmt.Errorf("what the mesh computes for this machine writes a seat's path: %s",
+			strings.Join(problems, "; "))
+	}
 	return generated, nil
 }