Hear a restricted stream only from a module's own account, never the tool runner's (issue 727)

The tool runner's bus account carried the heard grants, consumer and bind word of every module it runs, and every agent session on that machine reaches the bus as that account, so any session could pull a granted module's consumer on MAIL. Per ADR 0376 §1 the controller now composes a restricted stream's consumer, grants and bind word only for a module that declares runs-as; registration refuses a consumes of a restricted stream without runs-as (§2), and a grant that composes nothing is said in doctor (D-heard) and in the controller's log on every raise and send.

cmd/mesh-controller/doctor.go

@@ -146,6 +146,11 @@ var probeRegistry = []probe{
 	{ID: probeFillID, Asserts: "every module's bucket and log holds less than three quarters of its cap; one " +
 		"said filling is cleared once it holds less than seven tenths", From: "ADR 0297, issue 501",
 		Kind: kindBucketOrLogFilling, Raises: []string{kindBucketOrLogUnread}, Phase: 1, run: probeFill},
+	// A grant of a restricted stream that composes nothing (novox/hq ADR 0376 §2): the module is carried by the
+	// machine's tool runner, which never hears a restricted stream, so it hears nothing it was granted.
+	{ID: probeWithheldID, Asserts: "no grant of a restricted stream names a module that composes nothing for it: every " +
+		"module granted one runs as an account of its own", From: "ADR 0376 §2", Kind: kindGrantComposesNothing,
+		Phase: 1, run: probeWithheldHearing},
 	{ID: "DW", Asserts: "the watchdogs of the signals table ran within three of their intervals",
 		From: "ADR 0227 rule 6: the watchers are watched", Kind: "watchdogs-silent", Phase: 1, run: probeWatchdogs},
 	// The core's health definitions (novox/hq to-be 45 §8, ADR 0236): what a core component's new build is