Judge a kept folder before every walk, and keep nothing a disk mounted over (hq ADR 0325 review)

A walk run while a dataset was unmounted wrote onto root's empty mount point, or
"dropped" entries from it and forgot the ones on the data; a folder kept while empty
below an unnamed mount was then swept whole once the disk mounted, with no warrant.
Every walk is now judged as an apply is, a changed mount judges the folder afresh, and
systemd .mount units and mounts seen are read for the first-sight rule. Widening a
mask caps the entries it limited, so the owning group gains nothing. The watch lets
go of removed folders, re-arms on lost notice, reads users under its lock and ends
with its context. A drop that cannot read an ACL is counted, a broken folder's words
carry no path, a grant's group that could not be left is tried again, and a folder's
stat is bounded.

cmd/mesh-host/kept.go

@@ -162,7 +162,8 @@ func judgeAccess(a judgedAccess) verdict {
 	case apply.VerdictRoot:
 		return verdict{state: link.StateUnhealthy, reason: apply.RootWords(v.Why)}
 	case apply.VerdictBroken:
-		return verdict{state: link.StateUnhealthy, reason: strings.ReplaceAll(v.Why, a.path, "the folder")}
+		// Its words carry no path (AccessVerdict says them so): the reason reaches the operator's channel.
+		return verdict{state: link.StateUnhealthy, reason: v.Why}
 	case apply.VerdictMake:
 		return verdict{state: link.StateUnhealthy, reason: "it is not there yet; the next apply makes it where " +
 			"its data lives (novox/hq ADR 0325 §9)"}
@@ -183,7 +184,7 @@ func judgeAccess(a judgedAccess) verdict {
 	look := apply.LookKept(a.path, a.users, apply.SweepLimits)
 	var faults []string
 	if look.Failed != "" {
-		faults = append(faults, "the sweep could not look: "+strings.ReplaceAll(look.Failed, a.path, "the folder"))
+		faults = append(faults, "the sweep could not look: "+apply.Pathless(errors.New(look.Failed)))
 	}
 	if len(look.Short) > 0 {
 		faults = append(faults, "the folder itself gives "+strings.Join(look.Short, ", ")+"; put back on the next "+