Refuse to take over a system account as one that never becomes root

The controller cannot read a machine's user database, so a name it is given
for the agents' account (hq ADR 0266) may be a service's own; taking it over
would hand agents that service's files. Refuse it, touching nothing.

internal/apply/user_test.go

@@ -292,3 +292,32 @@ func TestTheFoundShellIsNotOverwrittenByASecondChange(t *testing.T) {
 		t.Errorf("given back %q, not the shell from before the mesh", l.shells["operator"])
 	}
 }
+
+// An account declared never to become root is never a system account taken over (novox/hq ADR 0266): the
+// controller cannot tell a service's account from a free name, so the node-engine refuses it, touching nothing.
+func TestARootNeverAccountIsNotASystemAccountTakenOver(t *testing.T) {
+	l := &logins{shells: map[string]string{}}
+	run := func(ctx context.Context, name string, args ...string) (string, error) {
+		if name == "getent" && args[len(args)-1] == "postgres" {
+			l.asked = append(l.asked, name+" "+strings.Join(args, " "))
+			return "postgres:x:70:70::/var/lib/postgres:/usr/bin/nologin\n", nil
+		}
+		return l.run(ctx, name, args...)
+	}
+	declared := func(name string) string {
+		return `{"declaration":1,"resources":[{"id":"claude-code.agent-account","type":"user","name":"` + name + `","root":"never"}]}`
+	}
+	report, _, err := Apply(context.Background(), archHost(t), parse(t, declared("postgres")), store.State{},
+		store.OriginDeclared, run, nil, nil)
+	if err == nil || !strings.Contains(err.Error(), "system account") {
+		t.Fatalf("a system account is refused as the agents' account: %v %+v", err, report)
+	}
+	if l.did("usermod") || l.did("useradd") {
+		t.Fatalf("nothing is changed on the refused account: %v", l.asked)
+	}
+	l.shells["agent"] = "/bin/bash" // uid 1500 in the fake: a login
+	if _, _, err := Apply(context.Background(), archHost(t), parse(t, declared("agent")), store.State{},
+		store.OriginDeclared, run, nil, nil); err != nil {
+		t.Fatalf("a login's account is taken: %v", err)
+	}
+}