Merge main into feat/47-G-join11 (G takes in main before its push)

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

internal/compose/resolution/node_resolver_test.go

@@ -151,6 +151,16 @@ func TestTheCataloguesResolverHoldersWriteTheFileAndProvideSplitDNS(t *testing.T
 func TestTheCataloguesResolverComposesOnAMachine(t *testing.T) {
 	shelf := resolverShelf(t)
 	shelf["systemd-resolved"] = catalogueManifest(t, "systemd-resolved")
+	// The options line is the catalogue's own template's, never a literal of it here (design 50 resolver-wait §3).
+	options := ""
+	for _, l := range strings.Split(shelf["systemd-resolved"].Facts["resolvers"].Template, "\n") {
+		if strings.HasPrefix(l, "options ") {
+			options = l
+		}
+	}
+	if options == "" {
+		t.Fatal("the catalogue's resolver template has no options line")
+	}
 	got, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "systemd-resolved"}, splitDNSLaptop(), mcat.World{})
 	if err != nil {
 		t.Fatal(err)
@@ -166,7 +176,7 @@ func TestTheCataloguesResolverComposesOnAMachine(t *testing.T) {
 	ids := byID(out)
 	resolv, _ := ids["systemd-resolved.fact-resolvers"]["content"].(string)
 	kept, _ := ids["systemd-resolved.fact-kept"]["content"].(string)
-	if !strings.Contains(resolv, "\nnameserver 10.42.0.2\noptions timeout:1 attempts:2 edns0\n") || resolv != kept {
+	if !strings.Contains(resolv, "\nnameserver 10.42.0.2\n"+options+"\n") || resolv != kept {
 		t.Errorf("the resolver file does not name this machine's own resolver alone, or its copy differs:\n%s", resolv)
 	}
 	if ids["systemd-networkd.fact-resolvers"] != nil {