Pin the node-engine at its pull request rebased onto main

The engine's pull request now keeps main's placement guard (issue 339) and adds
only the agent-home rule; the pin follows it so the two are judged together
(hq ADR 0266). Move it to the engine's merged commit before this merges.

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -198,6 +198,12 @@ type File struct {
 	// by looking rather than by knowing which field won.
 	Sealed string `json:"sealed,omitempty"`
 
+	// Trusted is the catalogue's word on whether the settings this file's content took are trusted (novox/hq
+	// issue 339). It is the controller's to act on, and a controller takes it out before it sends a declaration.
+	// Accepted here, and nothing is done with it, so that a controller that passes it on — an older one, or one
+	// rolled back to — never costs a node its whole declaration. Not part of the file's digest.
+	Trusted *bool `json:"trusted,omitempty"`
+
 	// Secrets are sealed values put into Content where it says `${secret:name}`.
 	//
 	// **The one place a secret and a configuration meet, and it happens on the machine.** A