Keep quiet for the setuid search the engine now runs to completion (hq issue 361)

The node-engine's search has no bound any more: it runs at idle priority
and judges from its last complete, fresh result. The controller's quiet
while an agent account waits is the engine's rootsearch.Quiet, not the
old fifteen-minute bound, and the node-engine is pinned at its pull
request.

cmd/mesh-controller/probe_agent_root.go

@@ -25,7 +25,9 @@ import (
 //  1. the machine names an account agents run as (novox/hq ADR 0266), so no agent runs as the operator's
 //     account, which may become root;
 //  2. its node-engine — running as root, which no agent controls — judged that account unable to become root
-//     without a person, in a statement heard within the last 15 minutes (agentConfined, judgedConfined);
+//     without a person, in a statement heard within the last 15 minutes (agentConfined, judgedConfined). The
+//     engine gives that verdict only from a complete search for setuid programs younger than mesh-host's
+//     rootsearch.FreshFor; before one, it says "not judged yet", which is no pass (novox/hq issue 361);
 //  3. the login shell's `execute` is not served there (novox/hq ADR 0268): its holder's setting withholds it
 //     **and** the bus was asked and heard no `execute` answered there. `execute` runs commands as the machine's
 //     runtime account, which the mesh's acting tools give passwordless sudo; that account is taken to become
@@ -95,8 +97,8 @@ type rootFacts struct {
 	// Execute is whether the login shell's execute is served there; ExecuteWhy why, in words.
 	Execute    bool
 	ExecuteWhy string
-	// SearchPending is the agent account unjudged only because the node-engine's first setuid search runs,
-	// within its bound (ADR 0266's quiet window).
+	// SearchPending is the agent account unjudged only because the node-engine's setuid search runs, within
+	// the quiet the controller gives it (searchQuietFor; ADR 0266's quiet window, issue 361).
 	SearchPending bool
 }
 
@@ -106,7 +108,7 @@ type rootVerdict struct {
 	Free    bool      `json:"free"`
 	Why     string    `json:"why"`
 	Judged  time.Time `json:"judged"`
-	// Quiet is a machine not free only because its first setuid search still runs, within its bound: the
+	// Quiet is a machine not free only because its setuid search still runs, within searchQuietFor: the
 	// self-check raises nothing for it then (ADR 0266's quiet window). It is never free for it.
 	Quiet bool `json:"quiet,omitempty"`
 }
@@ -136,7 +138,7 @@ func judgeRoot(f rootFacts, now time.Time) rootVerdict {
 	}
 	if len(not) > 0 {
 		v.Why = strings.Join(not, "; ")
-		// The one failure is the agent account not judged yet, because its first search runs.
+		// The one failure is the agent account not judged yet, because its search runs.
 		v.Quiet = len(not) == 1 && f.SearchPending && f.AgentNamed && !f.Confined && len(f.Unread) == 0 && !f.Execute
 		return v
 	}
@@ -154,8 +156,8 @@ type rootReader struct {
 	asked   error
 	// confined is agentConfined; settings the login shell holder's settings on a machine. Replaceable in a test.
 	confined func(ctx context.Context, node string, now time.Time) (named, confined bool, why string, err error)
-	// quiet says the one thing keeping a machine's agent account unjudged is the node-engine's first setuid
-	// search, within its bound (ADR 0266, searchStillRunning). Read by the self-check alone, to raise nothing
+	// quiet says the one thing keeping a machine's agent account unjudged is the node-engine's setuid
+	// search, within searchQuietFor (ADR 0266, searchStillRunning). Read by the self-check alone, to raise nothing
 	// then; nil reads no quiet. It never makes a machine root-free.
 	quiet    func(ctx context.Context, node string, now time.Time) bool
 	settings func(ctx context.Context, node, module string) ([]catalogue.Layer, error)
@@ -304,8 +306,8 @@ func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, e
 	if r.read != nil {
 		return nil, r.read
 	}
-	// The self-check alone reads ADR 0266's quiet window: nothing raised while a machine's first setuid search
-	// runs, within its bound. The root-free verb never reads it, so the machine still answers not free.
+	// The self-check alone reads ADR 0266's quiet window: nothing raised while a machine's setuid search
+	// runs, within searchQuietFor. The root-free verb never reads it, so the machine still answers not free.
 	r.quiet = func(ctx context.Context, node string, now time.Time) bool {
 		n, err := inv.NodeByName(ctx, node)
 		if err != nil || n.AgentAccount == "" {