Start a rehearsal only at the controller's terminal as main now judges it (hq ADR 0259, ADR 0272)

rehearse refused only a verb's process. Since mesh-cli (ADR 0272 §4) the serving controller runs an
ordinary mesh-cli line without a verb, naming its caller: such a line, from an agent's account, read as
the terminal and could start a question the operator did not ask. rehearse now asks
startedAtTheTerminal. And main's mesh-cli test helper asked is cliAsked, beside the asker's asked.

cmd/mesh-controller/rehearse.go

@@ -12,7 +12,8 @@ package main
 // as on any other: it claims the ask once, checks the act is the one bound, performs nothing, and records the
 // hand-act `warrant` with who answered, through which channel, and the proofs. `hand-acts` then shows it.
 //
-// **The terminal's alone**: a command a verb runs (MESH_VERB set) is refused, so no agent starts a rehearsal — a
+// **The terminal's alone** (startedAtTheTerminal): a command a verb runs, an ordinary mesh-cli line and anything the
+// serving controller started are refused, so no agent starts a rehearsal — a
 // rehearsal is a question the operator expects, and one an agent could start would teach them to approve what they
 // did not ask for.
 
@@ -22,7 +23,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"os"
 	"time"
 
 	"github.com/nats-io/nats.go"
@@ -68,9 +68,12 @@ func doesRehearsal(act conditions.Action) string {
 }
 
 func rehearseCommand(ctx context.Context, args []string) error {
-	if os.Getenv(verbVar) != "" {
-		return errors.New("rehearse is the controller's terminal's alone: a verb may not start one, so no agent asks " +
-			"the operator a question they did not start (novox/hq ADR 0259)")
+	// The terminal as main judges it (startedAtTheTerminal): not a verb, not the serving controller or anything it
+	// started, and a mesh-cli line only when it is the control-node's operator's (novox/hq ADR 0272 §4).
+	if !startedAtTheTerminal() {
+		return errors.New("rehearse is the controller's terminal's alone: a verb, a mesh-cli line from anybody but " +
+			"the control-node's operator, or a process the serving controller started may not start one, so no agent " +
+			"asks the operator a question they did not start (novox/hq ADR 0259)")
 	}
 	set := flag.NewFlagSet("rehearse", flag.ContinueOnError)
 	lasts := set.Duration("for", 15*time.Minute, "how long the question waits for an answer")