Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

A module waiting for the operator's secret failed its first-node gate, held
every later walk and was said as 'nothing for you to do'. The node-engine's
new waiting state is checked against the manifest and the secrets given,
read by the gate as a wait for a person, and raised as needs-operator naming
the act. A secret family gives each part its own one-line secret, which the
mesh never makes, so the desk prompt can take each password.

internal/link/protocol.go

@@ -556,8 +556,21 @@ const (
 	StateStarting  = "starting"
 	StateHeld      = "held"
 	StateUnknown   = "unknown"
+	// StateWaiting is a resource whose module's tool check says it waits for the operator: a named own secret
+	// or setting not given yet (novox/hq ADR 0283). Not a fault; the controller checks the wait before it
+	// excuses it.
+	StateWaiting = "waiting"
 )
 
+// Wait is one thing a waiting resource waits for the operator to give: exactly one of Secret and Setting, the
+// part that waits and what the operator gives, in words (novox/hq ADR 0283; mesh-sdk go/health's shape).
+type Wait struct {
+	Part    string `json:"part"`
+	Secret  string `json:"secret,omitempty"`
+	Setting string `json:"setting,omitempty"`
+	What    string `json:"what"`
+}
+
 // ResourceHealth is one long-running resource's state.
 type ResourceHealth struct {
 	Module   string    `json:"module"`
@@ -581,6 +594,9 @@ type ResourceHealth struct {
 	// without a person (novox/hq ADR 0266): the engine judged that too, and a healthy verdict says it cannot.
 	// Empty from an engine older than RootContract, and on every other verdict.
 	Root string `json:"root,omitempty"`
+	// Waits is what a resource in StateWaiting waits for (novox/hq ADR 0283). Empty otherwise, and from an
+	// engine older than that.
+	Waits []Wait `json:"waits,omitempty"`
 }
 
 // HealthSaid is the health event's body: the machine and its statement. The machine is read from the