Stop a settings layer replacing what a provider serves (issue 696)

What a provider serves is its definition's (ADR 0348 clause 11): a layer
fills only the keys it asks for as ${setting:<key>}. Settle replaced any
served key a layer named, so a setting for one of a provider's files could
change what every consumer was told. influxdb on ace was the one live layer
relying on it and now serves its settings (mesh-catalog, merged first), so
grafana's data source composes byte for byte as before. UnusedSettings no
longer counts a literal served key as a place a setting lands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/catalogue/testdata/influxdb-served-by-setting/grafana-ace.json

@@ -0,0 +1,35 @@
+{
+  "grafana.bound-influxdb-api": {
+    "content": "{\n  \"as\": \"mesh_workstation_grafana\",\n  \"at\": \"workstation.internal\",\n  \"binding\": 1,\n  \"from\": \"workstation\",\n  \"generated\": \"by the mesh — do not edit; replaced whenever this changes. The credential is not here: it is sealed, in the file this module's manifest names under `secrets`\",\n  \"provision\": \"influxdb-api\",\n  \"serves\": {\n    \"bucket\": \"made-up-bucket\",\n    \"org\": \"made-up-org\",\n    \"port\": 8086,\n    \"scheme\": \"http\"\n  }\n}\n",
+    "id": "grafana.bound-influxdb-api",
+    "mode": "0644",
+    "path": "/var/lib/grafana/influxdb.json",
+    "type": "file"
+  },
+  "grafana.influxdb-datasource": {
+    "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: http://workstation.internal:8086\n    user: mesh_workstation_grafana\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: made-up-bucket\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
+    "id": "grafana.influxdb-datasource",
+    "mode": "0644",
+    "path": "/var/lib/grafana/influxdb-datasources/mesh-influxdb.yaml",
+    "type": "file"
+  },
+  "grafana.influxdb-datasources": {
+    "id": "grafana.influxdb-datasources",
+    "mode": "0755",
+    "owner": "472:0",
+    "path": "/var/lib/grafana/influxdb-datasources",
+    "type": "directory"
+  },
+  "grafana.mesh-state": {
+    "id": "grafana.mesh-state",
+    "mode": "0700",
+    "path": "/var/lib/mesh/grafana",
+    "type": "directory"
+  },
+  "grafana.state": {
+    "id": "grafana.state",
+    "mode": "0700",
+    "path": "/var/lib/grafana",
+    "type": "directory"
+  }
+}

internal/catalogue/testdata/influxdb-served-by-setting/grafana-unlayered.json

@@ -0,0 +1,35 @@
+{
+  "grafana.bound-influxdb-api": {
+    "content": "{\n  \"as\": \"mesh_workstation_grafana\",\n  \"at\": \"workstation.internal\",\n  \"binding\": 1,\n  \"from\": \"workstation\",\n  \"generated\": \"by the mesh — do not edit; replaced whenever this changes. The credential is not here: it is sealed, in the file this module's manifest names under `secrets`\",\n  \"provision\": \"influxdb-api\",\n  \"serves\": {\n    \"bucket\": \"default\",\n    \"org\": \"mesh\",\n    \"port\": 8086,\n    \"scheme\": \"http\"\n  }\n}\n",
+    "id": "grafana.bound-influxdb-api",
+    "mode": "0644",
+    "path": "/var/lib/grafana/influxdb.json",
+    "type": "file"
+  },
+  "grafana.influxdb-datasource": {
+    "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: http://workstation.internal:8086\n    user: mesh_workstation_grafana\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: default\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
+    "id": "grafana.influxdb-datasource",
+    "mode": "0644",
+    "path": "/var/lib/grafana/influxdb-datasources/mesh-influxdb.yaml",
+    "type": "file"
+  },
+  "grafana.influxdb-datasources": {
+    "id": "grafana.influxdb-datasources",
+    "mode": "0755",
+    "owner": "472:0",
+    "path": "/var/lib/grafana/influxdb-datasources",
+    "type": "directory"
+  },
+  "grafana.mesh-state": {
+    "id": "grafana.mesh-state",
+    "mode": "0700",
+    "path": "/var/lib/mesh/grafana",
+    "type": "directory"
+  },
+  "grafana.state": {
+    "id": "grafana.state",
+    "mode": "0700",
+    "path": "/var/lib/grafana",
+    "type": "directory"
+  }
+}