Watch the have bucket only where the node's grant allows, so a node composing itself is not refused by the bus (issue 1126)

The fold's watch of every have key ('>') was refused (permissions violation on
CONSUMER.CREATE KV_node-engine_have), and every self-composing agent stopped
after the seed. The composer now watches '*.node' (records) and '<node>.>' (its
own haves), as buscompose grants a node; the shadow watches '<node>.>' too. The
selfcompose tests check every watch and get against PermissionsFor(KindNode),
and the agent's integration tests run the agent as the node under that grant.

internal/selfcompose/shadow.go

@@ -95,7 +95,7 @@ func (s *Shadow) Run(ctx context.Context) error {
 		{delivery.ModulesBucket, ">", (*Composer).takeModule, nil},
 		{ResolvedBucket, node + ".>", (*Composer).takeValue, nil},
 		// What this node runs moved: an apply ends in its module's have.
-		{delivery.HaveBucket, node + ".*", nil, nil},
+		{delivery.HaveBucket, node + ".>", nil, nil},
 	}
 	type tagged struct {
 		in int