Replace a value given by hand like one the mesh made (hq ADR 0228)

A given own secret the module reads at start is held by nobody but that
module, so the mesh need not read it to replace it: secret rotate now
works on it, and a value given through secret accept is replaced on its
own after the module's first good start under the mesh. Only a value an
outside party issues (own-secrets "issued-by": "outside") or one the
module applies stays as given, refused with the reason.

cmd/mesh-controller/status_summary.go

@@ -178,6 +178,9 @@ var readingVerbs = map[string]bool{
 type nudgingListener struct {
 	link.Enrolment
 	summary *statusSummary
+	// open is the serving controller's stores, for replacing a given value after a module's first
+	// good start (novox/hq ADR 0228).
+	open *stores
 }
 
 func (l nudgingListener) Heard(ctx context.Context, report link.Report) (bool, error) {
@@ -189,5 +192,10 @@ func (l nudgingListener) Heard(ctx context.Context, report link.Report) (bool, e
 	if news {
 		l.summary.nudge()
 	}
+	if err == nil && l.open != nil && startedWell(report) {
+		// Off the report's path: replacing a given value sends the machine, and a report waits for
+		// nothing it caused (novox/hq ADR 0228).
+		go replaceGiven(context.WithoutCancel(ctx), l.open, report)
+	}
 	return news, err
 }