Pin mesh-grants to the mesh-sdk that composes no user from the node-engine's manifest, so the whole user list composes again (issue 774)

Second meeting of the engine-state-in-runner kind; thorough: the runner
never carries the engine module. The live placement names mesh-host,
and with its health state the runner was a second writer, so every
grant since 13:54 was held back. The seeded-placement test now carries
the engine's manifest and refuses any runner write of mesh-host_*.

modules/mesh-grants/go.mod

@@ -3,7 +3,7 @@ module mesh-grants
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030143623-83cf97b690f5
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030153027-6e7820395952
 	github.com/nats-io/nats.go v1.54.0
 )
 

modules/mesh-grants/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030143623-83cf97b690f5 h1:hyyaB1rU7uzlQZvWAxZ9P6pL/4LCFpOVXMRgn9F7fic=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030143623-83cf97b690f5/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030153027-6e7820395952 h1:zsYckNqAQHLRffqTd2JYrUo/Nw9JrgQaXV8TmCHWC6I=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030153027-6e7820395952/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-grants/grants_test.go

@@ -1122,6 +1122,9 @@ func TestGrants(t *testing.T) {
 		n.assign("novox", "claude-licence-manager")
 		n.manifestOf("node-tools", `{"module":"node-tools","version":"1"}`) // the machine's tool runner, which carries the seat
 		n.assign("novox", "node-tools")
+		// The live placement names mesh-host; with its manifest's state the runner once carried it and the whole list was
+		// refused as a second writer of the engine's health (issue 774, 2026-10-30): the shadow below now composes.
+		n.manifestOf(buscompose.EngineModule, `{"module":"mesh-host","version":"1","consumes":["restic.backed-up"],"state":[{"name":"health"}]}`)
 		n.put(grants.ReadHave, "novox.node", map[string]any{"v": 1})
 		pl, _ = delivery.EncodePlacement(seed)
 		n.states[grants.ReadPlacement] = map[string][]byte{"placement.novox": pl}
@@ -1144,6 +1147,9 @@ func TestGrants(t *testing.T) {
 				runtime = u
 			}
 		}
+		if slices.ContainsFunc(runtime.Publish, func(s string) bool { return strings.HasPrefix(s, "$KV.mesh-host_") }) {
+			t.Errorf("novox.node-tools is granted a write of the node-engine's state: %v", runtime.Publish)
+		}
 		for _, s := range live.Users[0].Subscribe {
 			if strings.Contains(s, ".call.") && !slices.Contains(runtime.Subscribe, s) {
 				t.Errorf("under the seeded placement novox.node-tools is not granted %s, which the bus grants it today", s)