One reader for a declaration file, because there were three

Found raising two machines: `apply <file>` refused the bundle example in
this repository with `invalid character '/'`. The bundle strips whole-line
comments; apply handed the raw bytes to the parser. So a file this repo
ships could be built into a binary and not applied from disk.

This is the third instance of one fault. There is already a test here
named "what validates is what is applied", written when `mesh-host
bundle` said yes and `reconcile` said no about the same artefact — two
paths to one thing, disagreeing. Fixing that instance left the shape
intact, so it came back somewhere else.

So the fix is structural rather than local: `declaration.ParseFileTrusted`
is the one way to read a declaration from disk, and the bundle and apply
both use it. Comment handling and its test now live in one place, since
having them in two is how it came to be done in two.

The wire format is untouched — over the link it stays exactly JSON,
because a format with a second thing to strip is a format with a second
thing to disagree about. Asserted, and confirmed to fail if the link
starts stripping.

internal/declaration/declaration_test.go

@@ -264,3 +264,45 @@ func TestTheVocabularyIsTheSixShapesTheBootstrapNeeds(t *testing.T) {
 			len(speaks), vocabulary())
 	}
 }
+
+func TestADeclarationFromDiskMayBeAnnotated(t *testing.T) {
+	// The bundle in this repository is mostly explanation of why each digest is what it is, and
+	// it could be built into a binary and not applied from disk — two readers for one file. The
+	// failure was `invalid character '/'`, which names the symptom and not the cause.
+	raw := []byte(`// why this exists
+{
+  "declaration": 1,
+  // and why this resource is here
+  "resources": [
+    {"id": "f", "type": "file", "path": "/etc/x", "content": "hello"}
+  ]
+}`)
+	d, err := ParseFileTrusted(raw)
+	if err != nil {
+		t.Fatalf("a file with comments was refused: %v", err)
+	}
+	if len(d.Resources) != 1 {
+		t.Fatalf("got %d resources", len(d.Resources))
+	}
+	// And the wire format is untouched: over the link it is exactly JSON, because a format with
+	// a second thing to strip is a format with a second thing to disagree about.
+	if _, err := Parse(raw); err == nil {
+		t.Fatal("the link accepted a declaration with comments in it")
+	}
+}
+
+func TestSomethingInsideAValueIsNotAComment(t *testing.T) {
+	// Every image reference has a `//` in it somewhere near. Only whole lines are dropped.
+	d, err := ParseFileTrusted([]byte(`{"declaration":1,"resources":[
+		{"id":"f","type":"file","path":"/etc/x","content":"see https://example.invalid/ for why"}]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	file, ok := d.Resources[0].(*File)
+	if !ok {
+		t.Fatalf("got %T", d.Resources[0])
+	}
+	if !strings.Contains(file.Content, "https://example.invalid/") {
+		t.Fatalf("a value was mangled: %q", file.Content)
+	}
+}