Never name the private network the mesh provides as a module missing its grant (issue 774)

mesh-wireguard is provided by the mesh itself (mesh-sdk delivery.ProvidedByMesh): no repository builds it, so the
indexer holds no fingerprint of it and the assigner never wants it by one; the controller composes it with the
node's own. The grants part named it "no fingerprint of the new form: the indexer holds no value of it" on every
pass, a warning nothing could clear (sweep 2026-10-30 item 6).

Quick fix: drop mesh-wireguard by name from the missing list.
Thorough fix, chosen as cheap and covering every module the mesh may provide later: MissingGrants passes over any
module ProvidedByMesh names. The controller says the same of it in mesh-control (its grants and switch lines).

modules/mesh-grants/grants_test.go

@@ -2193,6 +2193,8 @@ func TestGrants(t *testing.T) {
 			return nil
 		}
 		b.put(grants.ReadLease, grants.LeaseKey, map[string]any{"handed-to": "the operator's hand-over"})
+		// The private network the mesh provides is placed with no fingerprint by construction: never a missing grant.
+		b.assign("b", "mesh-wireguard")
 		fp := "src2:d4afe7a1abab5ccdbef6d8629b2245006a2aec60290f430f7b4756e2930ed60c"
 		b.put(grants.ReadModules, "mod-x", delivery.Module{V: delivery.Version, FP2: fp, Manifest: delivery.ManifestDigest([]byte(xManifest)),
 			Repository: "novox/Link2Pay", Commit: "5d20e8bfbc953c51e8ebe3c671fe883df9c36e15"})

modules/mesh-grants/internal/grants/grants.go

@@ -263,7 +263,7 @@ func (p *Part) loadedContents(in Inputs, read []User, readErr error) (map[string
 const GrantMissingCondition = "mesh-grants.grant-missing"
 
 // MissingGrants is each module assigned or placed on a machine that want leaves without a grant, `<module>: <why>`,
-// sorted: its manifest refused (skip), no fingerprint of the new form at the indexer's trunk, or no account with a hash
+// sorted, but a module the mesh provides itself, which is never wanted by fingerprint: its manifest refused (skip), no fingerprint of the new form at the indexer's trunk, or no account with a hash
 // in the vault (drop). **The fingerprint is the indexer's, never a commit's** (issue 1126: link2pay, snake, f1-circuits
 // and txt-game, whose source commit has not moved since a build of the old form, have a done key of the new form at it,
 // and that is the fingerprint granted). Pure.
@@ -276,6 +276,12 @@ func MissingGrants(in Inputs, want map[string]delivery.ControllerGrant, drop []s
 	}
 	var out []string
 	for _, module := range sortedKeys(placed) {
+		// A module the mesh provides itself (the private network) is built by no repository, so the indexer holds no
+		// fingerprint of it and the assigner wants none: the controller composes it with the node's own. It needs no grant,
+		// and naming it missing raised a warning nothing could clear (sweep 2026-10-30 item 6).
+		if delivery.ProvidedByMesh(module) {
+			continue
+		}
 		fp, has := in.Fingerprints[module]
 		key, err := delivery.PartGrantKey(module, fp)
 		if has && err == nil {