Read the bus's user-list file's place from what the node runs, not from the controller's compositions

The bus module on the bus node runs from what its agent holds (its own composition, or the declaration kept before the
switch: every novox have read 2026-11-02 names its own composition or none, and nats names a build alone), while
composed-<node> was written by the controller, which ended (issue 1126). The follower now looks at the agent's record
of what runs whenever it changed, writes again only when the file it names moved, and trusts no composition signer.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

cmd/mesh-host/nodeagent_integration_test.go

@@ -5,7 +5,6 @@ package main
 import (
 	"context"
 	"crypto/ed25519"
-	"encoding/base64"
 	"encoding/json"
 	"os"
 	"path/filepath"
@@ -45,7 +44,6 @@ type itBed struct {
 	opts     options
 	session  *link.Session
 	controll ed25519.PrivateKey
-	operator ed25519.PrivateKey
 	said     []string
 	// refusals are the bus's asynchronous errors on the node's connection: each permissions violation it met.
 	refusals []string
@@ -137,20 +135,12 @@ func newItBedAs(t *testing.T, principal buscompose.Principal) *itBed {
 		t.Fatal(err)
 	}
 	_, b.controll, _ = ed25519.GenerateKey(nil)
-	_, b.operator, _ = ed25519.GenerateKey(nil)
 	return b
 }
 
-// start runs the node agent under a session on the bus, trusting the controller's key, and the operator's when asked.
-func (b *itBed) start(trustOperator bool) (stop func()) {
+// start runs the node agent under a session on the bus.
+func (b *itBed) start() (stop func()) {
 	b.t.Helper()
-	if trustOperator {
-		pub := b.operator.Public().(ed25519.PublicKey)
-		if err := os.WriteFile(filepath.Join(filepath.Dir(b.opts.state), operatorKeysFile),
-			[]byte("# the operator\n"+base64.StdEncoding.EncodeToString(pub)+"\n"), 0o600); err != nil {
-			b.t.Fatal(err)
-		}
-	}
 	b.session = &link.Session{Membership: link.Membership{Node: itNode}, Timeout: 2 * time.Second,
 		Say: b.say, Keys: func() link.RecordKeys { return link.RecordKeys{} }}
 	b.session.Attach(context.Background(), link.OverNATS{Conn: b.nodeConn, JS: b.nodeJS, Node: itNode})
@@ -493,7 +483,7 @@ func h8(t *testing.T, b *itBed, checkBuild bool) (func(), h8state) {
 		t.Fatal(err)
 	}
 
-	stop := b.start(false)
+	stop := b.start()
 	// Not placed yet: the agent applies the controller's compositions, of which there are none. The catalogue's seed then
 	// places the node, and the agent begins again composing its own (ADR 0549 §4), with no restart of the engine.
 	time.Sleep(300 * time.Millisecond)