Put the tool runner in the own group of each module whose tools it runs (hq ADR 0334 §2)

A joining module's own directories belong to its own group, and its tools run in the
tool runner, which could not read them. An identity may now name the tool runner's
account: the engine puts it in mesh-<module> as it puts it in a library's group,
says the change as identity:<module> for the runner's unit to restart once, takes
it back when no identity names it, and refuses an account that is missing or root's.
The engine states contract 7.

internal/declaration/declaration.go

@@ -1564,6 +1564,9 @@ type Identity struct {
 	UID    int    `json:"uid"`
 	GID    int    `json:"gid"`
 	Groups []int  `json:"groups,omitempty"`
+	// Runner is the tool runner's account, put in the module's own group (novox/hq ADR 0334 §2) when its tools run
+	// on this machine. Absent for a module that declares no tools here, and from a controller older than ADR 0334.
+	Runner string `json:"runner,omitempty"`
 }
 
 // Group is one library's group, as the controller allocated it (ADR 0328 §3).
@@ -1707,6 +1710,9 @@ func checkIdentities(ids []Identity, groups []Group) []string {
 					"declaration makes", where, g))
 			}
 		}
+		if id.Runner != "" && !accountName.MatchString(id.Runner) {
+			problems = append(problems, fmt.Sprintf("%s: its runner %q is not an account's name", where, id.Runner))
+		}
 		names[id.Name], uids[id.UID] = true, id.Name
 	}
 	return problems