Let a module declare a stream of its own and restrict who hears it by a trusted config value (hq issue 718, ADR 0363)

mesh-mail's events must live on a stream of their own and reach only the modules the operator granted
an account (ADR 0359 §2, §4). The controller now creates a module's declared stream, publishes its events
on mesh.stream.<module>.event.<event>, and composes a consumer's durable consumer, filters and bus grants
on a restricted stream only where its consumes asks and the provider's trusted value names it; a consumer
that loses its grant has its consumer removed on the next assertion. Nothing changes while no manifest
declares a stream.

internal/catalogue/seats_declared.go

@@ -245,6 +245,8 @@ func IsUndeclaredSeat(problem string) bool { return strings.HasSuffix(problem, U
 
 func CatalogueProblems(shelf Shelf) []string {
 	var problems []string
+	// A stream name has one owner (novox/hq ADR 0363).
+	problems = append(problems, StreamNameProblems(shelf)...)
 
 	// Who declares what, and who declared it first.
 	declaredBy := map[string]string{}