Put the tool runner in the own group of each module whose tools it runs (hq ADR 0334 §2)

A joining module's own directories belong to its own group, and its tools run in the
tool runner, which could not read them. An identity may now name the tool runner's
account: the engine puts it in mesh-<module> as it puts it in a library's group,
says the change as identity:<module> for the runner's unit to restart once, takes
it back when no identity names it, and refuses an account that is missing or root's.
The engine states contract 7.

internal/link/messages.go

@@ -274,6 +274,12 @@ const IdentityContract = 5
 // it, its presence is what tells the controller this host may be sent those fields.
 const LibraryContract = 6
 
+// OwnGroupContract is the statement of a host that also reads an identity's `runner` (novox/hq ADR 0334 §2): it puts
+// the tool runner's account in the module's own group, takes it back when no identity names it, and says the change
+// as `identity:<module>`, which the tool runner's unit names under restart-on to be restarted once. Like the fields
+// before it, its presence is what tells the controller this host may be sent `runner` on an identity.
+const OwnGroupContract = 7
+
 // Health is one statement of every long-running resource's state on this machine (to-be 48 §4). Said in
 // every report, as an event on each change, and again every minute while anything is not healthy — so a
 // lost statement is not a lost fault.