Keep a module directory's setgid bit, warn about a refused runner, and restart the runner when it leaves (hq ADR 0334 review)

A module's own directories need setgid so what is made beneath keeps its own group,
and a mode of 2750 refused the whole declaration while every apply dropped the bit:
a directory's mode now carries setgid (never setuid or sticky), set, kept and said.
A tool runner's account that is missing or root's failed the whole apply and dropped
the library's outcome: it is now a warning, said as runner:<module> or
runner:library:<name>. And a runner that leaves a group is taken out before the
resources apply, so its unit is restarted in that apply to lose it.

cmd/mesh-host/libraries.go

@@ -163,10 +163,25 @@ func (j *libraryJudge) look(now time.Time) ([]link.ResourceHealth, bool) {
 		read[i] = v
 	}
 
+	// And every tool runner's account the last apply could not put in a group, as a resource of its own (ADR 0334
+	// §2): unhealthy, never failing the apply.
+	warnings := apply.RunnerWarnings()
+
 	j.mu.Lock()
 	defer j.mu.Unlock()
 	changed := false
-	out := make([]link.ResourceHealth, 0, len(ls))
+	out := make([]link.ResourceHealth, 0, len(ls)+len(warnings))
+	for _, w := range warnings {
+		v := link.ResourceHealth{Module: w.Module, Resource: w.Resource, Kind: link.KindRunner, State: link.StateUnhealthy,
+			Reason: "the tool runner's account joins no group: " + w.Why, Since: now.UTC(), Streak: 1}
+		if was, had := j.was[w.Resource]; had && was.Reason == v.Reason {
+			v.Since, v.Streak = was.Since, was.Streak+1
+		} else {
+			changed = true
+		}
+		j.was[w.Resource] = v
+		out = append(out, v)
+	}
 	for i, l := range ls {
 		r := read[i]
 		id := apply.LibraryAccess(l.Library)