The node agent hands the vault what runs of an own secret its shadow answer says another value of, through move-in's replace_running, while it applies the controller's compositions (issue 1126, cause C4)

A new step, internal/ownresync, after each shadow answer: for each own secret masked as another value, while the node
applies the controller's compositions and runs the one its want names, it asks the vault's move-in with
replace_running: true and the running value sealed to the call's key, once per value, and says what it asked and what
the vault answered. The answer written to the node's have key carries values_differ. Pins the group's mesh-sdk head
1062b33 (go.sum is filled once that head is pushed).

cmd/mesh-host/ownresync.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"github.com/novox/mesh-host/internal/identity"
+	"github.com/novox/mesh-host/internal/link"
+	"github.com/novox/mesh-host/internal/ownresync"
+	"github.com/novox/mesh-host/internal/selfcompose"
+)
+
+// composesNow is whose compositions this run of the agent applies, once decided ("" before).
+type composesNow struct {
+	mu  sync.Mutex
+	now string
+}
+
+func (c *composesNow) set(s string) { c.mu.Lock(); c.now = s; c.mu.Unlock() }
+func (c *composesNow) get() string  { c.mu.Lock(); defer c.mu.Unlock(); return c.now }
+
+// resyncStep is the step that hands the vault what runs of an own secret a shadow answer says another value of (issue
+// 1126, cause C4; internal/ownresync): one pass at a time, and the last answers taken again once the agent has decided
+// whose compositions it applies.
+type resyncStep struct {
+	r    *ownresync.Resync
+	one  sync.Mutex
+	mu   sync.Mutex
+	last map[string]delivery.CandidateAnswer
+}
+
+func ownResync(session *link.Session, node string, say func(string), env selfcompose.Env, composes *composesNow) *resyncStep {
+	return &resyncStep{r: ownresync.New(ownresync.Env{Node: node, Composes: composes.get, Running: env.Running,
+		Get: env.Get, Unseal: env.Unseal, Seal: identity.Seal, Say: say,
+		Ask: func(ctx context.Context, verb string, args map[string]any) (json.RawMessage, error) {
+			return session.AskVault(ctx, verb, args)
+		}})}
+}
+
+// take keeps answers as the last and takes them.
+func (s *resyncStep) take(ctx context.Context, answers map[string]delivery.CandidateAnswer) {
+	s.mu.Lock()
+	s.last = answers
+	s.mu.Unlock()
+	s.again(ctx)
+}
+
+// again takes the last answers.
+func (s *resyncStep) again(ctx context.Context) {
+	s.one.Lock()
+	defer s.one.Unlock()
+	s.mu.Lock()
+	last := s.last
+	s.mu.Unlock()
+	if last != nil {
+		s.r.Take(ctx, last)
+	}
+}