Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

Tests that read ../../../mesh-catalog or ../../../mesh-host gave a verdict
that depended on what sat beside the checkout: a stale or dirty sibling
failed them on a desktop, and a missing one skipped them unseen. They now
read the clone the build seat puts in MESH_CHECK_BESIDE, failing when it is
absent there, and elsewhere a copy captured at a named commit.

The skip had hidden that the builder test read a module retired by ADR 0190.
The systemd reading test no longer counts the machine's own environment.d.

testdata/beside/mesh-catalog/modules/ollama/module.json.captured

@@ -0,0 +1,61 @@
+{
+  "module": "ollama",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "provides": [
+    {
+      "name": "model-access",
+      "scope": "node"
+    }
+  ],
+  "listens": [
+    {
+      "name": "api",
+      "port": 11434,
+      "protocol": "tcp",
+      "from": "machine",
+      "why": "consumers on this machine reaching the local model server's OpenAI-compatible API"
+    }
+  ],
+  "serves": {
+    "model-access": {
+      "port": 11434,
+      "model": "llama3.2"
+    }
+  },
+  "data": {
+    "own": [
+      {
+        "id": "models",
+        "path": "${dir:state}",
+        "class": "rebuildable",
+        "backup": "none",
+        "measure": "shallow",
+        "why": "models, downloaded again, and too large to copy every night"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/services/ollama",
+      "mode": "0700"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "ollama",
+      "image": "ollama/ollama@sha256:32931b46719f673c05fdbaa81ccb26da18ea4a1c57590a754874ab28ba269eb2",
+      "network": "host",
+      "env": {
+        "OLLAMA_HOST": "0.0.0.0:11434"
+      },
+      "volumes": [
+        "/services/ollama:/root/.ollama"
+      ]
+    }
+  ]
+}