A node holds its link open, and applies what the mesh signs

The loop the whole thing exists for: told, apply, report.

`run` holds one outbound connection open and consumes the node's own queue.
Every declaration is verified against the control plane's signing key before a
byte of it is read as an instruction -- not once at connect, every time. The
transport being pinned is a different question from the instruction being
genuine, and pinning only the first would make the second transitive: a
compromised broker could forge declarations, and this host applies whatever the
link delivers.

Malformed and forged are reported differently, because ADR 0004 requires a host
to tell "this is not from the mesh I joined" from "this is broken". One means
somebody is trying and the other means something needs fixing.

A node now keeps what it needs to come back on its own: the broker's address
and fingerprint, the signing key it believes, and its own broker password --
which the mesh issues at enrolment to replace the token's secret, so the
one-time thing stays one-time and the credential it holds for years is not the
one that was pasted into a terminal.

Verified in the lab end to end. The node enrolled, held its link, received a
signed declaration and applied it -- the file is on the machine with the right
contents, and the host's own record lists both resources.

That run also found issue 010, which is recorded in novox/hq: the declaration
removed every container on the machine, including the control plane that sent
it. Correct reconciliation, shared store, and the first thing that happens.

internal/link/enrol.go

@@ -34,7 +34,16 @@ type EnrolReply struct {
 	Accepted bool   `json:"accepted"`
 	Node     string `json:"node,omitempty"`
 	Queue    string `json:"queue,omitempty"`
-	Refusal  string `json:"refusal,omitempty"`
+
+	// What this node keeps so it can come back on its own. Without these a restart would need a
+	// person with a new token, which would make disconnection a crisis rather than the ordinary
+	// situation novox/hq ADR 0004 says it is.
+	Password    string `json:"password,omitempty"`
+	Broker      string `json:"broker,omitempty"`
+	Fingerprint string `json:"fingerprint,omitempty"`
+	Signer      []byte `json:"signer,omitempty"`
+
+	Refusal string `json:"refusal,omitempty"`
 }
 
 // ErrRefused is what a node gets when the mesh will not have it.