Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

ADR 0328 supersedes ADR 0325: shared data is a library with one home, kept usable by
its group rather than by ACL entries. The engine now makes each library's group and
each module's user in its libraries' groups; keeps a library's root and requested
sub-paths in its group with group write and setgid on its home, making missing
sub-paths as the root is; waits for the operator's word before touching a root that
holds data, and on the take act walks it by descriptor (no link, same filesystem,
bounded and resumed, files with other names left); holds the containers of a library
whose disk or mount is not there; and puts the tool runner's account in the group.
The ACL keeping, mask repair and watch are gone; an access is again as before ADR 0325.

cmd/mesh-host/units_test.go

@@ -87,10 +87,10 @@ func TestTheStatementSaysAnAccountJudgedForRoot(t *testing.T) {
 			Groups: []string{"openrazer"}}, State: accounts.Healthy, Since: at},
 	}}
 	h := withAccounts(healthAsReported(liveness.Statement{At: at}, nil), as)
-	// At RootContract or later: an engine that also reads identities and keeps shared folders says IdentityContract
-	// (novox/hq ADR 0325), one above ADR 0312's GrantContract.
-	if h.Contract < link.RootContract || link.RootContract != 3 || h.Contract != link.IdentityContract ||
-		link.IdentityContract != link.GrantContract+1 {
+	// At RootContract or later: an engine that also reads libraries says LibraryContract (novox/hq ADR 0328), one
+	// above ADR 0325's IdentityContract.
+	if h.Contract < link.RootContract || link.RootContract != 3 || h.Contract != link.LibraryContract ||
+		link.LibraryContract != link.IdentityContract+1 {
 		t.Fatalf("contract %d", h.Contract)
 	}
 	got := map[string]string{}