Trust the vault's key alone and write the grants part's user list alone

The controller ended by its unassignment and its lease is never handed, so
the engine's lease gate kept trusting the controller's key and the bus node
kept the controller's list as a fallback nobody writes (issue 1126, A6).
The engine now trusts no controller signature, its hand-over line names the
node seat's hand-over, and the user-list follower writes only the grants
part's list: a key unreadable or deleted keeps the list loaded, and with no
key heard nothing is written. Compositions in the node's bucket name the
file's place alone. The guard no longer asks for the controller's user.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

cmd/mesh-host/main.go

@@ -1113,17 +1113,16 @@ func runLink(ctx context.Context, opts options) error {
 	// the bus, answer what the controller asks of this machine, and say its facts: when a link opens, and when the
 	// controller asks.
 	proof := &proving{statePath: opts.state, version: runningVersion(), say: say}
-	// What this engine trusts a mesh signature from: the controller's key until its lease is handed away, and the vault's
-	// once read from its signers (novox/hq ADR 0550 §2).
-	trust := newMeshTrust(mine.Membership.Signer)
-	// And the way out a directory used as found names follows the lease it hears (novox/hq ADR 0563 §5).
-	foundTrust.Store(trust)
+	// What this engine trusts a mesh signature from: the vault's key alone, once read from its signers (novox/hq ADR 0550
+	// §2; issue 1126: the controller's key never, the controller ended by its unassignment).
+	trust := newMeshTrust()
 	queue := &link.Session{
 		Membership: membership,
 		// And the public halves and certificate its record says (novox/hq ADR 0555 §3), read at each facts report.
 		Keys: recordKeys(opts.state, trust.Trusts),
-		// And the controller's key, read per signed ask: none once its lease is handed away (novox/hq ADR 0563 §7).
-		ControllerKey: trust.Controller,
+		// And no controller's key: every ask the controller would sign is refused, never verified with the membership's
+		// signer (novox/hq ADR 0563 §7; issue 1126, the controller ended by its unassignment).
+		ControllerKey: noControllerKey,
 		// And the first have this build writes is what proves it to the launcher (ADR 0539 §9, ADR 0227 §8).
 		HaveWritten: proof.haveWritten,
 		// And the operator's hand-over of a directory used as found, carried by the controller from the