Follow no link below a home as root, and judge more ways to root

An account could replace ~/.claude with a link to /etc and have the
node-engine chown, chmod or write through it on the next apply. Below a
person's or an agent's home every component is now opened without
following a link, and a link refuses the resource in words.

The root judge also reads doas and polkit rules, the container runtimes'
sockets with their ACLs, ACLs on the secrets, and setuid-root programs no
package owns, in the C locale; Judged and NotJudged write down exactly
what it covers (hq ADR 0266 review).

cmd/mesh-host/main.go

@@ -1095,7 +1095,7 @@ func runLink(ctx context.Context, opts options) error {
 		// And which units its service managers say failed, and whose each is (novox/hq issue 315).
 		unitJudge = units.New(units.Exec{Run: apply.ExecRunner, System: builtFor})
 		// And whether an account a module put in a group has it where it runs (novox/hq ADR 0252).
-		accountJudge = accounts.New(accounts.Exec{Run: accounts.Runner(apply.ExecRunner)})
+		accountJudge = accounts.New(accounts.Exec{Run: accounts.CLocale, Cache: &accounts.SetuidCache{Every: time.Hour}})
 	}
 
 	// **Standing aside for a successor happens between reconciles and nowhere else** (novox/hq ADR