Merge main (the R4g finish: reads-outside markers) into feat/r6 (issue 1945)

The silent mid-tier plan test main changed stays deleted with the plans (ADR 0539); the SDK is pinned to the feat/r6
head that merged mesh-sdk's main, 748c564c, whose hand path tool is now mesh-hand-compose.

internal/broker/nats.go

@@ -780,7 +780,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// itself, its replies to the asker's own inbox.
 		pub = append(pub, discovering()...)
 		// And, for an administrator (`*`, the operator), release 6's hand path (ADR 0539 clauses 2 and 10): a want written
-		// at the terminal, and a composition made by hand with mesh-compose.
+		// at the terminal, and a composition made by hand with mesh-hand-compose.
 		if administers(p.Invokes) {
 			hand, err := HandPathWrites(p.FilesFor)
 			if err != nil {

internal/broker/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).