Grant the grants part reading every membership; seal the seeded account in the addresses test (ADR 0547 §5, review; issue 1945)

The grants part reads each module's last membership before it publishes, so it is granted the direct get on every
membership subject beside the publish (review of mesh-grants, B1).

The test TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker failed on main since PR #467: it seeds
anchor.mesh-controller with no seal, and an account counts as issued only once sealed (ADR 0543 §2). The rule is right;
the fixture is fixed, sealing the seeded credential the controller already uses. Test only.

internal/broker/membership_test.go

@@ -79,6 +79,8 @@ func TestAnAccountMayReadItsOwnMembershipAndNoOthers(t *testing.T) {
 		t.Fatal(err)
 	}
 	has(t, grants.Publish, "mesh.assignment.*.*")
+	has(t, grants.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
+	hasNot(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
 	hasNot(t, grants.Publish, "$JS.API.STREAM.CREATE.>")
 	hasNot(t, grants.Publish, "mesh.assignment.>")
 }

internal/broker/nats.go

@@ -916,9 +916,10 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			pub = append(pub, BusConnzSubject)
 		}
 		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
-		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, and no stream it defines.
+		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each
+		// first so it publishes only what changed, and no stream it defines.
 		if p.Module == GrantsModule {
-			pub = append(pub, "mesh.assignment.*.*")
+			pub = append(pub, "mesh.assignment.*.*", "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment.*.*")
 		}
 		// The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a).
 		if p.Module == ViewModule {