A pin names the module as well as the node; a node that answers twice is refused

A provider is a (node, module) pair (design 23), and the pin — the one way a
consumer names its provider — named only the node. Two modules on one node
can both answer a provision (public-acme and step-ca both offer acme-ca on
novox), and then the resolver, given a pin naming that node, took the last
provider listed: a coin flip. The same ambiguity beside the consumer was
settled by a map walk — random per plan — which is how novox's own
route-proxy got its issuer (novox/hq #258).

- `pin <node> <provision> <from-node> <module>`: both halves, always. The
  console gains `pin` and `unpin`. The provider may be on the consumer's own
  node, since two modules beside it can both answer.
- The resolver refuses ambiguity instead of picking, across machines and
  beside the consumer alike, naming every candidate as node/module and the
  form of the pin that settles it. A plain capability that grants nothing
  and serves nothing (three shells beside an editor) is not a choice to put
  to anybody and stays as it was.
- provision_pin gains a nullable module (0050); records made before are
  completed where the node they name answers once, and left for a person
  where it answers twice (0051).
- The provider of something already satisfied is looked for among what was
  assigned, not only what the walk has reached — a consumer reached before
  the provider beside it no longer loses its binding.
- The start-time check that every declared verb is runnable samples each
  verb's required arguments from its schema instead of three guessed keys.

Live consequence: a node that has two providers of one bound provision
assigned (novox: acme-ca) resolves only once pinned —
`pin novox acme-ca novox public-acme`.

cmd/mesh-controller/seatverbs.go

@@ -79,6 +79,16 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 			return nil, err
 		}
 		return []string{verb, str("node"), str("module")}, nil
+	case "pin":
+		if err := need("node", "provision", "from", "module"); err != nil {
+			return nil, err
+		}
+		return []string{"pin", str("node"), str("provision"), str("from"), str("module")}, nil
+	case "unpin":
+		if err := need("node", "provision"); err != nil {
+			return nil, err
+		}
+		return []string{"unpin", str("node"), str("provision")}, nil
 	case "push":
 		// Sent and not waited for: the asker reads `status` for what the machine did, which is
 		// what a person at a shell does too. A tool call that blocked for a push's whole apply would
@@ -176,7 +186,7 @@ func seatToolHandlers() (map[string]link.ToolHandler, error) {
 			}
 			continue
 		}
-		if _, err := argvFor(verb, map[string]any{"node": "x", "module": "x", "repository": "x"}); err != nil {
+		if _, err := argvFor(verb, sampleArguments(v)); err != nil {
 			return nil, fmt.Errorf("the %s seat's row declares %q, which this control plane cannot run: %w",
 				catalogue.ControllerSeatName, verb, err)
 		}
@@ -215,3 +225,22 @@ func seatTools() map[string]any {
 	}
 	return map[string]any{"seats": seats}
 }
+
+// sampleArguments is one of every argument a verb's schema requires, so the check at start proves the
+// verb runnable rather than that it happens to want the arguments the check guessed.
+func sampleArguments(v catalogue.Verb) map[string]any {
+	sample := map[string]any{"node": "x", "module": "x", "repository": "x"}
+	switch required := v.Input["required"].(type) {
+	case []string:
+		for _, k := range required {
+			sample[k] = "x"
+		}
+	case []any:
+		for _, k := range required {
+			if name, ok := k.(string); ok {
+				sample[name] = "x"
+			}
+		}
+	}
+	return sample
+}