Hear a restricted stream only from a module's own account, never the tool runner's (issue 727)

The tool runner's bus account carried the heard grants, consumer and bind word of every module it runs, and every agent session on that machine reaches the bus as that account, so any session could pull a granted module's consumer on MAIL. Per ADR 0376 §1 the controller now composes a restricted stream's consumer, grants and bind word only for a module that declares runs-as; registration refuses a consumes of a restricted stream without runs-as (§2), and a grant that composes nothing is said in doctor (D-heard) and in the controller's log on every raise and send.

internal/catalogue/streams.go

@@ -311,6 +311,41 @@ func StreamNameProblems(shelf Shelf) []string {
 	return problems
 }
 
+// RestrictedHearingProblems refuses a module that would hear a restricted stream without an account of its own
+// (novox/hq ADR 0376 §2): a `consumes` naming a module literally and asking for events a restricted stream of
+// that module carries, by a manifest that declares no `runs-as`. A module the machine's tool runner carries
+// reaches the bus as the tool runner's account, which every agent session there shares, so the controller would
+// compose nothing for it. Judged only where the provider is on the shelf, as a consumer may be installed before
+// its emitter; a wildcard emitter never reaches a module's stream (ADR 0363 §5) and is not judged.
+func RestrictedHearingProblems(shelf Shelf) []string {
+	var problems []string
+	for _, module := range shelfOrder(shelf) {
+		m := shelf[module]
+		if m.RunsAs != "" {
+			continue
+		}
+		for _, c := range m.Consumes {
+			emitter, rest, named := strings.Cut(c, ".")
+			provider, known := shelf[emitter]
+			if !named || emitter == OneName || emitter == TheRest || !known {
+				continue
+			}
+			hearing, _ := provider.StreamsHearing(rest)
+			for _, s := range hearing {
+				if s.Grant == nil {
+					continue
+				}
+				problems = append(problems, fmt.Sprintf(
+					"%s consumes %s, which %s's restricted stream %s carries, so %s must run as an account of its "+
+						"own (runs-as): the machine's runtime runs as the operator's account, which every agent "+
+						"runs as, and never hears a restricted stream (novox/hq ADR 0376)",
+					module, c, emitter, s.BusName(), module))
+			}
+		}
+	}
+	return problems
+}
+
 // GrantedKeys reads a restricting config value (novox/hq ADR 0363 §4): each key whose list names the
 // module wherever it runs, or the module on this machine as `<machine>.<module>`. A value of another shape
 // grants nothing; a key that is not one usable name grants nothing.