Keep the mesh's trust anchors at the terminal, refuse containerd's tree, and read a found directory as a wait

The review of #170: step-ca's root, roots and path and the identity
provider's issuer are what every consumer trusts, and any caller of the
settings verb could replace them; they are now terminal keys like places and
accesses (hq issue 339). /var/lib/containerd joins the runtimes' data. And a
directory the node-engine uses as found failed its module's gate and rolled
its builds back; found before the send, it is now a wait for a person the
gate passes with, as a relogin is (ADR 0254), and only one the send itself
found holds the module.

cmd/mesh-controller/modules.go

@@ -1062,12 +1062,12 @@ func declaresTools(m catalogue.Manifest) bool {
 	return false
 }
 
-// terminalSettings are the keys no verb may change (novox/hq issue 339). `places` says where the node-engine
-// creates and, as root, owns a module's directories, with an owner the setting names; `accesses` says which of
-// the machine's paths are mounted into a module's container. Set through a verb, either lets any caller of the
-// mesh's console — an agent among them — have root hand it a directory, or mount one of the machine's into a
-// container it reaches. They are the operator's, typed at the controller's terminal.
-var terminalSettings = []string{catalogue.PlacesSetting, catalogue.AccessesSetting}
+// The keys no verb may change are catalogue.TerminalKeys (novox/hq issue 339). `places` says where the
+// node-engine creates and, as root, owns a module's directories, with an owner the setting names; `accesses` says
+// which of the machine's paths are mounted into a module's container; a provider's trust anchors say what every
+// consumer trusts. Set through a verb, any of them lets any caller of the mesh's verbs — an agent among them —
+// have root hand it a directory, mount one of the machine's into a container it reaches, or have the mesh trust
+// an authority of its own. They are the operator's, typed at the controller's terminal.
 
 // throughAVerb says whether this process runs a seat verb's command line: the serving controller names the
 // verb in the environment of every command it runs for one (runVerb), and a person at the terminal runs none.
@@ -1085,16 +1085,16 @@ func refuseTerminalSettingsThroughAVerb(before, after map[string]any, module, wh
 	if !through {
 		return nil
 	}
-	for _, key := range terminalSettings {
+	for _, key := range catalogue.TerminalKeys(module) {
 		was, _ := json.Marshal(before[key])
 		now, _ := json.Marshal(after[key])
 		if string(was) == string(now) {
 			continue
 		}
 		return fmt.Errorf("%s of %s on %s is set at the controller's terminal only, never through a verb (this "+
-			"line came through %q): it says where root creates and owns a module's directories, or which of "+
-			"the machine's paths are mounted into its container, and whoever may call a verb includes agents "+
-			"(novox/hq issue 339). Nothing was changed", key, module, where, verb)
+			"line came through %q): it says where root creates and owns a module's directories, which of "+
+			"the machine's paths are mounted into its container, or what the mesh's consumers trust, and whoever "+
+			"may call a verb includes agents (novox/hq issue 339). Nothing was changed", key, module, where, verb)
 	}
 	return nil
 }