Put the tool runner in the own group of each module whose tools it runs (hq ADR 0334 §2)

A joining module's own directories belong to its own group, and its tools run in the
tool runner, which could not read them. An identity may now name the tool runner's
account: the engine puts it in mesh-<module> as it puts it in a library's group,
says the change as identity:<module> for the runner's unit to restart once, takes
it back when no identity names it, and refuses an account that is missing or root's.
The engine states contract 7.

internal/store/store.go

@@ -267,7 +267,9 @@ type MadeGroup struct {
 type Membership struct {
 	Account string `json:"account"`
 	Group   string `json:"group"`
-	Library string `json:"library"`
+	// Library is the library whose group it is; Module, for a module's own group (ADR 0334 §2), the module.
+	Library string `json:"library,omitempty"`
+	Module  string `json:"module,omitempty"`
 }
 
 // MadeIdentity is one module identity as the engine made it.