Name the account agents run as on a node, and say whether it can become root

On the control node every agent ran as the operator's account, which has
passwordless sudo, so an agent could become root without a person (hq ADR
0266). A node now names an agent account at the controller's terminal only;
the agent's module declares it never to become root, the node-engine judges
that, and the self-check (DA) raises agent-can-become-root while it does not
hold, so ADR 0259's router can rest on it.

cmd/mesh-controller/plain_words.go

@@ -110,6 +110,15 @@ var plainWordings = map[string]func(conditions.Observation) words{
 				"reaches it. It keeps running what it has.", m),
 			Resolved: m + " can get new instructions again"}
 	}),
+	kindAgentCanBecomeRoot: worded(func(o conditions.Observation) words {
+		m := machineOr(o, "a machine")
+		return words{Headline: "Sessions on " + m + " could become root",
+			Needs: "take the sessions' own account out of every group and rule that grants root; the details say which.",
+			Explanation: fmt.Sprintf("Assistant sessions on %s run under an account of their own, so that none "+
+				"can take over the machine without you. The machine cannot show that this holds now, so an answer "+
+				"from your phone authorises nothing there until it does.", m),
+			Resolved: "Sessions on " + m + " cannot become root again"}
+	}),
 	"own-address-banned": worded(func(o conditions.Observation) words {
 		m := machineOr(o, "a machine")
 		return words{Headline: m + " has banned the mesh",