Carry the controller's new self-check grant; stop telling people to delete kept data (hq ADR 0233)

The installer's first user list must match the controller's composed grant, which now reads every
machine's backup holder; and a kept directory's report pointed at the one act that loses data.

internal/apply/apply.go

@@ -1615,10 +1615,15 @@ func remove(ctx context.Context, sys system.System, a store.Applied, run Runner,
 		if err != nil {
 			return "", "", err
 		}
+		// **And it is never removed by hand on this host's word** (novox/hq ADR 0233). What a module
+		// declares as its data the controller retires — kept, listed by `cleanup list` — and only a
+		// person's `cleanup delete` removes it, after a last restore point. This line used to say
+		// "remove it by hand", which is the one instruction that takes the restore point away.
 		if len(entries) > 0 {
 			return "kept", fmt.Sprintf(
-				"no longer declared, and %d item(s) inside that the mesh did not put there — "+
-					"remove it by hand once you know what it is", len(entries)), nil
+				"no longer declared, and %d item(s) inside that the mesh did not put there — kept: an "+
+					"unassignment never deletes data; if it is a module's declared data the mesh retires it "+
+					"(`cleanup list`), and only `cleanup delete` removes it", len(entries)), nil
 		}
 		if err := os.Remove(a.Target); err != nil {
 			return "", "", err

internal/apply/apply_test.go

@@ -1565,6 +1565,12 @@ func TestADirectoryHoldingAnythingTheMeshDidNotPutThereIsKept(t *testing.T) {
 	for _, o := range report.Outcomes {
 		if o.Action == "kept" && strings.Contains(o.Detail, "did not put there") {
 			said = true
+			// And it says how data goes, which is never by hand on this line's word (novox/hq ADR
+			// 0233): a person's `cleanup delete`, after a last restore point.
+			if strings.Contains(o.Detail, "by hand") || !strings.Contains(o.Detail, "never deletes data") ||
+				!strings.Contains(o.Detail, "cleanup delete") {
+				t.Errorf("the kept directory is said as %q", o.Detail)
+			}
 		}
 	}
 	if !said {