Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk
carries no composition rule. The catalogue functions only the
node-engine's composition reaches (Resolve, Resolution's Compose,
Declaration, DataItems, LeftOut, Rules and the rest, the settings,
placeholder and template refusals, the rendering helpers) are copied
with their tests into internal/compose/resolution; a method of a
mesh-sdk shape becomes a function taking it first. The composition
calls its own copies, and the captured catalogue its tests read lives
here now, shared by mesh-compose's tests.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

internal/compose/resolution/core_credentials.go

@@ -0,0 +1,19 @@
+package resolution
+
+import (
+	"encoding/json"
+	"slices"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// CarriesVaultSealed says whether module's own secrets are the core's credentials.
+func CarriesVaultSealed(module string) bool {
+	return slices.Contains(mcat.CoreCredentialModules, module)
+}
+
+// vaultSealedOf is the vault's box for one of module's own secrets, if the rendering was given one.
+func renderingVaultSealedOf(with mcat.Rendering, module, name string) (json.RawMessage, bool) {
+	box, ok := with.VaultSealed[module][name]
+	return box, ok && len(box) > 0
+}