Refuse a node's accounts through any verb, and a stale or service-account agent verdict

The generic command verb ran node account and node agent-account, so an agent
could name itself the operator account and have the next send grant it root
(hq ADR 0266 review). Refuse every node subcommand but list and show through
any verb; refuse the operator account as the agent account in both
directions and well-known service accounts as an agent account; and count a
verdict heard more than 15 minutes ago as not judged, so stopping the
node-engine cannot freeze a healthy one. Re-pin mesh-host to its review head.

internal/inventory/nodes.go

@@ -192,7 +192,23 @@ func scanNode(row pgx.Row) (Node, error) {
 // SetAccount records the operator account on a node — its human login — and optionally where that
 // account's home is (novox/hq to-be 29). An empty home means the mesh derives it. Clearing the
 // account (empty name) is allowed: a machine may stop having a known operator.
+//
+// **Never the node's agent account** (novox/hq ADR 0266): the operator account may become root, and the
+// agent account exists so agents cannot; naming the one as the other gives agents root. Refused here as
+// SetAgentAccount refuses the other direction.
 func (i *Inventory) SetAccount(ctx context.Context, node, account, home string) error {
+	account = strings.TrimSpace(account)
+	if account != "" {
+		n, err := i.NodeByName(ctx, node)
+		if err != nil {
+			return err
+		}
+		if n.AgentAccount != "" && n.AgentAccount == account {
+			return fmt.Errorf("%s is %s's agent account: the operator account may become root, and agents run as "+
+				"%s so that they cannot (novox/hq ADR 0266); clear the agent account first "+
+				"(node agent-account %s --clear) if the operator is to log in as it", account, node, account, node)
+		}
+	}
 	tag, err := i.store.Pool().Exec(ctx,
 		`update node set account = $1, account_home = $2 where name = $3`, account, home, node)
 	if err != nil {
@@ -244,6 +260,24 @@ func (i *Inventory) SetAgentAccount(ctx context.Context, node, account, home str
 	return nil
 }
 
+// serviceAccounts are the system and service accounts a machine of the mesh has, or a module of the
+// catalogue declares (showcase, and the accounts ADR 0259 gives the router and the channels). The controller
+// cannot read a machine's user database, so this list is the controller's half; the node-engine's half is
+// refusing to take an existing account below the first login uid as one that must never become root.
+var serviceAccounts = map[string]bool{
+	"root": true, "bin": true, "daemon": true, "sys": true, "adm": true, "nobody": true, "mail": true,
+	"ftp": true, "http": true, "www-data": true, "git": true, "sshd": true, "dbus": true, "polkitd": true,
+	"postgres": true, "docker": true, "nats": true, "redis": true, "uuidd": true, "dnsmasq": true,
+	"avahi": true, "rtkit": true, "colord": true, "geoclue": true, "tss": true, "alpm": true, "usbmux": true,
+	"showcase": true, "messenger": true, "telegram": true,
+}
+
+// serviceAccount says whether a name is a system or service account: one of the list, or a name of
+// systemd's own (systemd-…).
+func serviceAccount(name string) bool {
+	return serviceAccounts[name] || strings.HasPrefix(name, "systemd-")
+}
+
 // AgentAccountRefusal is why an agent account cannot be named, or nil: root, a malformed login, or a
 // home that is not an absolute path.
 func AgentAccountRefusal(account, home string) error {
@@ -255,6 +289,11 @@ func AgentAccountRefusal(account, home string) error {
 		return fmt.Errorf("%q is not a login name: lower case letters, digits, _ and -, a letter or _ first, "+
 			"at most 32", account)
 	}
+	if serviceAccount(account) {
+		return fmt.Errorf("%q is a system or service account a machine or a module already has: the agent "+
+			"account is one the mesh creates for agents alone, which nothing else runs as or owns files as "+
+			"(novox/hq ADR 0266); name a new one, such as agent", account)
+	}
 	if home != "" && !strings.HasPrefix(home, "/") {
 		return fmt.Errorf("the agent account's home %q is not an absolute path", home)
 	}