Key root-not-free apart from DA, keep ADR 0266's quiet window there, and judge at one clock (hq ADR 0259 §8)

The confirmation review of 2026-10-09 found D-root and DA writing one key, machine.<m>.agent-root, from
two probes with different words, so it flapped every run; D-root is now root-not-free. D-root raised the
urgent condition after every node-engine restart while the first setuid search ran; it now keeps the
same quiet window as DA, and the root-free verb still answers that machine not free. agentConfined
takes the judging clock.

cmd/mesh-controller/agent_account.go

@@ -48,7 +48,8 @@ const agentAccountProbe = "DA"
 //
 // The one judgement: `node show`, the self-check, and ADR 0259's router honouring a verified sender read
 // it here.
-func agentConfined(ctx context.Context, inv *inventory.Inventory, node string) (named, confined bool, why string, err error) {
+// now is the judging clock, threaded so a caller judging several things at one instant judges them all at it.
+func agentConfined(ctx context.Context, inv *inventory.Inventory, node string, now time.Time) (named, confined bool, why string, err error) {
 	n, err := inv.NodeByName(ctx, node)
 	if err != nil {
 		return false, false, "", err
@@ -61,7 +62,7 @@ func agentConfined(ctx context.Context, inv *inventory.Inventory, node string) (
 	if err != nil {
 		return true, false, "", err
 	}
-	confined, why = judgedConfined(n.AgentAccount, h, had, time.Now())
+	confined, why = judgedConfined(n.AgentAccount, h, had, now)
 	return true, confined, why, nil
 }
 
@@ -228,7 +229,7 @@ func agentAccountLines(ctx context.Context, inv *inventory.Inventory, n inventor
 		return []string{fmt.Sprintf("  agents run as      the operator account (%s); no agent account is named",
 			orNoneKnown(n.Account))}
 	}
-	_, confined, why, err := agentConfined(ctx, inv, n.Name)
+	_, confined, why, err := agentConfined(ctx, inv, n.Name, time.Now())
 	if err != nil {
 		return []string{fmt.Sprintf("  agents run as      %s (home %s); whether it can become root could NOT be read: %v",
 			n.AgentAccount, n.AgentHome(), err)}