An address is read from the node's settings where it is used, never recorded with a port

Three readers did not follow a moved foundation port (novox/hq 04-ISSUES/102),
and each took the control-node down in its own way: the control plane's own
store and broker connections, sealed at genesis with the port inside; and every
build the mesh ever recorded, kept as `<registry>:<port>/<module>/<artifact>@…`.

The control plane cannot open its own sealed connections to move a port, and it
cannot bind the store as a consumer would — a binding mints a credential. So its
settings get a third twin, `NAME_PORT`, read on top of the sealed value by the
store, the broker, the management API and the bus connection, and filled into
its container by a placeholder that names a seat, `${seat:mesh-store:5432}`,
from the node's given or mesh-assigned ports — never the manifest's number, and
empty when the mesh has nothing to add, so what genesis wrote stands. A value
that is still a placeholder is nothing said, aloud: the manifest naming it lands
in the next commit, once every control plane that composes it knows it.

A build is now recorded by digest and path — `artifact-store://<module>/<artifact>@…`
— and the store's address is composed in where a reference is used: the
declaration, the trust file, the bases a build is handed, a replay to the
catalogue. Over the network as `<node>.internal:<port>`; on the store's own node
before any network exists — every genesis push before its "network" step — by
loopback. A reference recorded before this, with an address, is re-routed the
same way when the mesh built it. The trust file and every provider's address
come from one derivation: the node's given port, over the mesh's assignment,
over the manifest's number.

novox/hq 04-ISSUES/102

internal/store/settings_test.go

@@ -213,3 +213,55 @@ func mustNotLeak(t *testing.T, err error) {
 		t.Fatalf("the password is in the error: %v", err)
 	}
 }
+
+// The node moved the store, and the control plane's own connection follows (novox/hq 04-ISSUES/102).
+//
+// The connection string is what genesis wrote, port and all; the port twin is what the node's
+// settings say now. The pool's configuration is the one place both meet.
+func TestThePortTwinMovesTheStoresPort(t *testing.T) {
+	alone(t)
+	t.Setenv(PortVariable(example), "")
+	path := filepath.Join(t.TempDir(), "inventory")
+	if err := os.WriteFile(path, []byte(dsn+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(FileVariable(example), path)
+
+	opened, err := Open(t.Context(), example)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := opened.Pool().Config().ConnConfig.Port; got != 5432 {
+		t.Fatalf("with nothing said, the store is on %d rather than what the file says", got)
+	}
+	opened.Close()
+
+	t.Setenv(PortVariable(example), "6852")
+	opened, err = Open(t.Context(), example)
+	if err != nil {
+		t.Fatalf("a moved port was refused: %v", err)
+	}
+	defer opened.Close()
+	if got := opened.Pool().Config().ConnConfig.Port; got != 6852 {
+		t.Fatalf("the store is on %d, and the node put it on 6852", got)
+	}
+	if got := opened.Pool().Config().ConnConfig.Password; got != "s3cret-in-here" {
+		t.Fatalf("moving the port changed the password to %q", got)
+	}
+}
+
+func TestAPortTwinThatIsNotAPortNamesItselfAndNotTheSecret(t *testing.T) {
+	alone(t)
+	t.Setenv(Variable(example), dsn)
+	t.Setenv(PortVariable(example), "six")
+	_, err := Open(t.Context(), example)
+	if err == nil {
+		t.Fatal("a port that is not a number was accepted")
+	}
+	if !strings.Contains(err.Error(), PortVariable(example)) {
+		t.Errorf("the error does not name the variable: %v", err)
+	}
+	if strings.Contains(err.Error(), "s3cret") {
+		t.Errorf("the error quotes the password: %v", err)
+	}
+}