Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

ADR 0328 supersedes ADR 0325: shared data is a library with one home, kept usable by
its group rather than by ACL entries. The engine now makes each library's group and
each module's user in its libraries' groups; keeps a library's root and requested
sub-paths in its group with group write and setgid on its home, making missing
sub-paths as the root is; waits for the operator's word before touching a root that
holds data, and on the take act walks it by descriptor (no link, same filesystem,
bounded and resumed, files with other names left); holds the containers of a library
whose disk or mount is not there; and puts the tool runner's account in the group.
The ACL keeping, mask repair and watch are gone; an access is again as before ADR 0325.

internal/apply/placed.go

@@ -11,7 +11,7 @@ import (
 	"time"
 )
 
-// Whether a shared folder's disk is there (novox/hq ADR 0325 §9).
+// Whether a library's disk is there (novox/hq ADR 0328 §9; first ADR 0325 §9).
 //
 // **The rule the engine keeps.** A folder is placed on the filesystem it is first seen on: the mount point that
 // holds it — the longest mount point in /proc/self/mountinfo that is the folder or above it — is recorded beside the
@@ -20,7 +20,7 @@ import (
 // the disk not there. A recorded mount point that is mounted while another holds the folder is a **move**: what is
 // at the path now is not what was kept (a disk mounted over a folder first seen empty below it, a mount made
 // deeper), so the folder is judged afresh — kept again only if it holds nothing, else it waits for the operator's
-// word as any folder holding data does (ADR 0325 §8).
+// word as any folder holding data does (ADR 0328 §7).
 //
 // **On first sight, with no record,** the engine knows a disk is missing only from where disks are meant to be:
 // every mount target in /etc/fstab, every `Where=` of a systemd .mount unit, every mount point a ZFS dataset names