Key root-not-free apart from DA, keep ADR 0266's quiet window there, and judge at one clock (hq ADR 0259 §8)

The confirmation review of 2026-10-09 found D-root and DA writing one key, machine.<m>.agent-root, from
two probes with different words, so it flapped every run; D-root is now root-not-free. D-root raised the
urgent condition after every node-engine restart while the first setuid search ran; it now keeps the
same quiet window as DA, and the root-free verb still answers that machine not free. agentConfined
takes the judging clock.

cmd/mesh-controller/agent_account_test.go

@@ -106,10 +106,10 @@ func TestTheSelfCheckSaysAnAgentAccountThatCanBecomeRoot(t *testing.T) {
 	if found, err = probeAgentAccounts(ctx, d); err != nil || len(onlyMachine(found, "anchor")) != 0 {
 		t.Fatalf("a judged agent account still fails: %+v %v", found, err)
 	}
-	if named, confined, why, err := agentConfined(ctx, inv, "anchor"); err != nil || !named || !confined {
+	if named, confined, why, err := agentConfined(ctx, inv, "anchor", time.Now()); err != nil || !named || !confined {
 		t.Fatalf("agentConfined on anchor: %v %v %q %v", named, confined, why, err)
 	}
-	if named, _, why, err := agentConfined(ctx, inv, "laptop"); err != nil || named ||
+	if named, _, why, err := agentConfined(ctx, inv, "laptop", time.Now()); err != nil || named ||
 		!strings.Contains(why, "operator account") {
 		t.Fatalf("agentConfined on a machine naming none: %v %q %v", named, why, err)
 	}
@@ -246,7 +246,7 @@ func TestASearchStillRunningAfterARestartIsNotUrgent(t *testing.T) {
 	if found := say(link.StateUnknown, running); len(found) != 0 {
 		t.Fatalf("a search first seen now was raised: %+v", found)
 	}
-	if _, confined, why, _ := agentConfined(ctx, inv, "anchor"); confined || !strings.Contains(why, "not judged") {
+	if _, confined, why, _ := agentConfined(ctx, inv, "anchor", time.Now()); confined || !strings.Contains(why, "not judged") {
 		t.Fatalf("an account whose search runs was read as confined: %q", why)
 	}
 	// The engine restarted again and again, each statement's own since fresh: the controller's clock runs on.