Let a directory say how it reacts to files it does not know, and move out what a move-out directory does not know (issue 1024, ADR 0422)

A directory or archive resource carries `unknown` (move-out, module, program) and `knows`. For move-out under a home, every look moves each path the declaration does not know into ~/.local/state/mesh-moved/<module>/<time>/, the list written before each move, without following a link, a young path waiting, a socket or pipe left and reported, nothing made when nothing moved, and another file system refused. Reviewed in two rounds.

internal/apply/test_hooks.go

@@ -0,0 +1,10 @@
+package apply
+
+// UseAccountsFileForTest makes the accounts and homes this package knows come from the user database at path, until
+// the returned function is called. For the node-engine's own integration tests, which cannot name a home any other
+// way; nothing in the node-engine calls it (issue 1024).
+func UseAccountsFileForTest(path string) (restore func()) {
+	was := passwdFile
+	passwdFile = path
+	return func() { passwdFile = was }
+}