Pin the group's final mesh-sdk 206f794e with its captured conformance files, and read the engine's superseded word on a secret move (issue 774)

The captured SDK (testdata/beside, conformance/events) is taken again at the pinned commit, as CAPTURED
says. The controller's mirror of MoveSecretAnswer gains `superseded` (mesh-host b9c24a7): the vault holds
another value, the live one, and the machine's older value is not moved and not asked again. The field
test names it. A superseded row is still counted with the moved ones: counting it apart needs a field and
its words in nodeMove, more than the one line asked.

internal/link/movesecret.go

@@ -52,6 +52,9 @@ type MoveSecretAnswer struct {
 	Secret     string `json:"secret,omitempty"`
 	Generation int    `json:"generation,omitempty"`
 	Unchanged  bool   `json:"unchanged,omitempty"`
+	// Superseded says the vault holds another value of the secret, which is the live one, and this machine's older value
+	// was not moved and is not asked again (mesh-host b9c24a7, sweep 2026-10-30).
+	Superseded bool `json:"superseded,omitempty"`
 }
 
 // MoveSecretWithin is how long the controller waits for one move: the engine asks the vault twice.

internal/link/movesecret_test.go

@@ -30,8 +30,9 @@ func TestTheMovesAskAndAnswerKeepTheirFieldNames(t *testing.T) {
 		"provision sealed sealed_to" {
 		t.Fatalf("the ask's fields are %q", got)
 	}
-	answer := MoveSecretAnswer{Said: "s", Refused: "r", Secret: "own/a/b/c", Generation: 1, Unchanged: true}
-	if got := keys(answer); got != "generation refused said secret unchanged" {
+	answer := MoveSecretAnswer{Said: "s", Refused: "r", Secret: "own/a/b/c", Generation: 1, Unchanged: true,
+		Superseded: true}
+	if got := keys(answer); got != "generation refused said secret superseded unchanged" {
 		t.Fatalf("the answer's fields are %q", got)
 	}
 	if broker.AskMoveSecretSubject("laptop") != "mesh.node.laptop.ask.move-secret" ||