Start a rehearsal only at the controller's terminal as main now judges it (hq ADR 0259, ADR 0272)

rehearse refused only a verb's process. Since mesh-cli (ADR 0272 §4) the serving controller runs an
ordinary mesh-cli line without a verb, naming its caller: such a line, from an agent's account, read as
the terminal and could start a question the operator did not ask. rehearse now asks
startedAtTheTerminal. And main's mesh-cli test helper asked is cliAsked, beside the asker's asked.

cmd/mesh-controller/rehearse_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"github.com/novox/mesh-controller/internal/link"
 	"strings"
 	"testing"
 	"time"
@@ -54,6 +55,21 @@ func TestARehearsalIsTheTerminalsAlone(t *testing.T) {
 	if err := rehearseCommand(context.Background(), nil); err == nil || !strings.Contains(err.Error(), "terminal") {
 		t.Fatalf("a verb started a rehearsal: %v", err)
 	}
+	// Nor a mesh-cli line from anybody but the control-node's operator (hq ADR 0272 §4): run without a verb,
+	// naming its caller, and without the terminal's mark — and nor anything the serving controller started.
+	for name, env := range map[string]map[string]string{
+		"an ordinary mesh-cli line":            {verbVar: "", link.CallerVar: "laptop/agent"},
+		"a process the serving controller ran": {verbVar: "", servedVar: "1"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			for k, v := range env {
+				t.Setenv(k, v)
+			}
+			if err := rehearseCommand(context.Background(), nil); err == nil || !strings.Contains(err.Error(), "terminal") {
+				t.Fatalf("%s started a rehearsal: %v", name, err)
+			}
+		})
+	}
 }
 
 // askerRehearsalFor is how long the test's rehearsal waits.