Pin the node-engine at its pull request rebased onto main

The engine's pull request now keeps main's placement guard (issue 339) and adds
only the agent-home rule; the pin follows it so the two are judged together
(hq ADR 0266). Move it to the engine's merged commit before this merges.

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -198,6 +198,12 @@ type File struct {
 	// by looking rather than by knowing which field won.
 	Sealed string `json:"sealed,omitempty"`
 
+	// Trusted is the catalogue's word on whether the settings this file's content took are trusted (novox/hq
+	// issue 339). It is the controller's to act on, and a controller takes it out before it sends a declaration.
+	// Accepted here, and nothing is done with it, so that a controller that passes it on — an older one, or one
+	// rolled back to — never costs a node its whole declaration. Not part of the file's digest.
+	Trusted *bool `json:"trusted,omitempty"`
+
 	// Secrets are sealed values put into Content where it says `${secret:name}`.
 	//
 	// **The one place a secret and a configuration meet, and it happens on the machine.** A

vendor/modules.txt

@@ -75,7 +75,7 @@ github.com/nats-io/nkeys
 # github.com/nats-io/nuid v1.0.1
 ## explicit
 github.com/nats-io/nuid
-# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261008195316-9a85dffc11a2
+# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4
 ## explicit; go 1.26.0
 github.com/novox/mesh-host/internal/declaration
 github.com/novox/mesh-host/validate
@@ -133,4 +133,4 @@ golang.org/x/text/width
 # golang.org/x/time v0.15.0
 ## explicit; go 1.25.0
 golang.org/x/time/rate
-# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261008195316-9a85dffc11a2
+# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4