Replace a value given by hand like one the mesh made (hq ADR 0228)

A given own secret the module reads at start is held by nobody but that
module, so the mesh need not read it to replace it: secret rotate now
works on it, and a value given through secret accept is replaced on its
own after the module's first good start under the mesh. Only a value an
outside party issues (own-secrets "issued-by": "outside") or one the
module applies stays as given, refused with the reason.

internal/link/events.go

@@ -63,6 +63,9 @@ const (
 	// KeyBuiltBefore: a build the mesh already held, for a catalogue that asked what it missed. Not
 	// `built` — that is the build machine's, said as it happens, and a replay is neither.
 	KeyBuiltBefore = "built-before"
+	// KeySecretReplaced: a value given to the mesh by hand was replaced with one it made, after its
+	// module's first good start (novox/hq ADR 0228). Never the value.
+	KeySecretReplaced = "secret-replaced"
 )
 
 // Applied is what a machine now runs, as the mesh states it.