A claim problem or a refused credential holds its module, not the whole pass (issue 1966, S1 and S5)

The node-engine refused the whole pass when two modules claimed a seat held once, or when a consumer's credential was
refused. Now the composer leaves that module out of the declaration and composes the rest: the module is returned held
(Resolved.Held, resolution.ResolveHolding), reaches the declaration as left out through the filter and the declaration
#218 already keep (Rendering.NotPlaced), and Declared.LeftOut names it. The second claimant of a seat is the one held;
its claim is not this node's holding. The rest-of-mesh view and the network use the same, so a node with a held module
stays on the network. Resolve stays strict for callers that cannot leave a module out.

Quick fix: hold only the credential refusal (resolve.go planForNow), about 20 minutes. Thorough fix, chosen: every
claim problem is attributed to its module (claimsOf) and both kinds go through the one left-out path of ADR 0163 rule 6,
in the declaration, the filter and the network, so no per-kind refusal of a pass remains in the composer. Left for the
next step: a declared-and-not-made own secret (NotMadeError) and the Foreseeing-mode refusal still refuse the pass; the
frombus candidate path holds those by stub already.

Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5

internal/compose/render.go

@@ -114,6 +114,17 @@ func (c *composer) render(nodeName string, mode Mode) (Rendered, error) {
 		out.CoreBoxesWanted = wanted
 	}
 
+	// A module whose claim cannot be held, or whose credential was refused, is left out of the declaration and run as it runs:
+	// the machine composes the rest (issue 1966, ADR 0636 §3).
+	for module, why := range resolved.Held {
+		if r.NotPlaced == nil {
+			r.NotPlaced = map[string]string{}
+		}
+		if _, said := r.NotPlaced[module]; !said {
+			r.NotPlaced[module] = why
+		}
+	}
+
 	// And a certificate for this machine's name inside the mesh, when anything on it asks.
 	for _, m := range plan.Modules {
 		if m.Certificate == nil {