Refuse a placement or mount at the machine's own trees, and use a found directory as found

A module's places setting could point a directory anywhere, with an owner it
named, and the engine chowned and chmodded whatever it was pointed at as root,
through a link too; its accesses setting could mount any path into a container
(hq issue 339). The engine now refuses, as a failed resource with its reason,
a directory, access or mount source that is or holds one of the machine's
roots, anything placed in the kernel's, the boot loader's, root's or the
engine's own trees, a non-root directory below /etc, /usr or /run, an access
there, another account's directory below a home, and a container mounting
anything it refused, judged with every link resolved. A directory whose last
component is a link is refused, and one found here that the mesh did not make
keeps its owner and mode and is never removed.

internal/store/store.go

@@ -131,6 +131,11 @@ type Applied struct {
 	// anything else in the directory, and leaves it in place.
 	Unpacked *Unpacked `json:"unpacked,omitempty"`
 
+	// AsFound is, for a directory, that it was there before the mesh first applied it and was not the
+	// declared owner and mode (novox/hq issue 339): the mesh uses it as found, never changing its owner or
+	// mode, and never removes it. Absent on a record from before: such a directory is the mesh's.
+	AsFound bool `json:"as_found,omitempty"`
+
 	// Reads is, for a container, the digest of each file it was created reading — its env-files
 	// and the files mounted into it — by path (novox/hq 04-ISSUES/103).
 	//