Refuse a node's accounts through any verb, and a stale or service-account agent verdict

The generic command verb ran node account and node agent-account, so an agent
could name itself the operator account and have the next send grant it root
(hq ADR 0266 review). Refuse every node subcommand but list and show through
any verb; refuse the operator account as the agent account in both
directions and well-known service accounts as an agent account; and count a
verdict heard more than 15 minutes ago as not judged, so stopping the
node-engine cannot freeze a healthy one. Re-pin mesh-host to its review head.

internal/catalogue/verbs.go

@@ -268,9 +268,10 @@ var ControllerVerbs = []Verb{
 				"machine it is assigned to with where it comes from; module and node narrow it (novox/hq ADR 0262)",
 		}, nil, "clear", "replace", "history")},
 	{Name: "command", Description: "Run one command line of the controller's own, as you would type it at its " +
-		"shell — `node account g14 jochen`, `node show ace`, `module list` — and answer what it printed. The " +
-		"generic verb beside the named ones (novox/hq ADR 0154): everything the binary can do, without a verb " +
-		"per command. Any node may call any tool (ADR 0175), so nothing is held back here.",
+		"shell — `node show ace`, `module list` — and answer what it printed. The generic verb beside the named " +
+		"ones (novox/hq ADR 0154): what the binary can do, without a verb per command. Held back: every `node` " +
+		"command but `node list` and `node show` — a node's accounts decide who may become root on it, and are " +
+		"set at the controller's terminal only (ADR 0266).",
 		Input: schema(map[string]string{
 			"command": "the command line, as the controller's binary takes it; quotes group a word with spaces",
 		}, []string{"command"})},