No container is given the mesh's names; it resolves them

novox/hq ADR 0148, step 3. Every container got the whole roster as
--add-host entries at creation and nothing re-read them (issues 109,
135); once the roster was in the digest so that could be caught, one
name moving anywhere replaced every container in the mesh (issue 151).
A container resolves through its machine's resolver, which the resolver
module tells the runtime about once per machine. A module's own hosts
entries stay exactly as declared.

Also brings the resolver tests up to the catalogue as it now is: the
runtime is reloaded (never restarted) and given live-restore, and the
resolver answers by address, not by interface (issue 110).

internal/catalogue/declaration.go

@@ -618,17 +618,15 @@ func (r Resolution) compose(with Rendering, owner map[string]string) ([]map[stri
 		// merging earlier would throw away the files it still needs.
 		resources = append(append([]map[string]any{}, first...), resources...)
 
-		// Every container is given the mesh's names. Not a choice a module makes: a module that
-		// listed them would go stale the day a machine joins, and one that did not would be a
-		// module whose containers cannot reach anything by name.
-		//
-		// A container that was given names of its own keeps them and gets the mesh's beside them:
-		// the mesh does not know what else a workload needs to reach, and taking something away
-		// to add something is not what "also" means.
-		if len(with.Names) > 0 {
-			resources = withMeshNames(resources, with.Names)
-		}
-
+		// No container is given the mesh's names (novox/hq ADR 0148). It used to be: every
+		// container got the whole roster as `--add-host` entries at creation, and a name that
+		// moved afterwards was wrong inside it for as long as it ran (issues 109, 135) — and once
+		// the roster was made part of a container's identity so that could be caught, one name
+		// moving anywhere replaced every container in the mesh (issue 151). A container resolves a
+		// mesh name through its machine's resolver at the moment it asks, which the runtime is
+		// told once per machine, as a file, by the resolver's own module. The names a module
+		// declares for itself are its own and stay exactly as written: they are part of what the
+		// module is, and the mesh does not know what they mean.
 		// What this module may name from inside one of its own files. Gathered once per module
 		// rather than per file, because it is a fact about the module.
 		sealed, err := sealedFor(m, r.Needs, with)
@@ -1482,43 +1480,6 @@ func (r Resolution) servedOnThisMachine(provision string, with Rendering) (map[s
 	return nil, false, nil
 }
 
-// withMeshNames gives every container in a set the mesh's names.
-//
-// Copied rather than edited in place: these maps come from a module's manifest, and mutating one
-// would change what the catalogue holds for every other machine running that module.
-//
-// A host-network container gets the names too. It was once skipped, on the belief that it "shares
-// the machine's hosts file already" — but it does not: `docker run --network host` still gives the
-// container its own /etc/hosts (localhost and its own id only), so every `<node>.internal` name the
-// mesh wrote for the machine is invisible inside it, and a client that dials one gets EAI_AGAIN. The
-// remedy is the same `--add-host` every other container gets — the runtime accepts it with
-// `--network host` (verified), and without it a host-network consumer cannot reach a provider by the
-// `.internal` address the mesh hands it as `${bound:...:at}`.
-func withMeshNames(resources []map[string]any, names map[string]string) []map[string]any {
-	out := make([]map[string]any, 0, len(resources))
-	for _, r := range resources {
-		if r["type"] != "container" {
-			out = append(out, r)
-			continue
-		}
-
-		copied := map[string]any{}
-		for k, v := range r {
-			copied[k] = v
-		}
-		var given []any
-		if already, ok := copied["hosts"].([]any); ok {
-			given = append(given, already...)
-		}
-		for _, name := range sortedKeys(names) {
-			given = append(given, name+":"+names[name])
-		}
-		copied["hosts"] = given
-		out = append(out, copied)
-	}
-	return out
-}
-
 // pinned refuses an image that is not really pinned, on its way to a machine.
 //
 // **Here and not at parse** (novox/hq 04-ISSUES/025). A manifest in a repository names artifacts