Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk
carries no composition rule. The catalogue functions only the
node-engine's composition reaches (Resolve, Resolution's Compose,
Declaration, DataItems, LeftOut, Rules and the rest, the settings,
placeholder and template refusals, the rendering helpers) are copied
with their tests into internal/compose/resolution; a method of a
mesh-sdk shape becomes a function taking it first. The composition
calls its own copies, and the captured catalogue its tests read lives
here now, shared by mesh-compose's tests.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

internal/compose/resolution/runonce_test.go

@@ -0,0 +1,54 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// indexOfID returns the position of the resource with the given (module-prefixed) id, or -1.
+func indexOfID(out []map[string]any, id string) int {
+	for i, r := range out {
+		if r["id"] == id {
+			return i
+		}
+	}
+	return -1
+}
+
+func TestARunOnceContainerRendersBeforeTheContainerItGates(t *testing.T) {
+	// The gate is declaration order, not a resolved dependency: the step is written before the
+	// container that needs it, and the host applies in order and stops at a step that did not
+	// complete. So the control plane must carry run-once through untouched and must not reorder the
+	// two containers.
+	digest := "@sha256:" + strings.Repeat("a", 64)
+	r := mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{{
+		Module: "mosquitto",
+		Resources: []map[string]any{
+			{"id": "seed", "type": "container", "name": "seed",
+				"image": "registry.example/runtime" + digest, "run-once": true},
+			{"id": "server", "type": "container", "name": "broker",
+				"image": "registry.example/broker" + digest},
+		},
+	}}}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	seed := indexOfID(out, "mosquitto.seed")
+	server := indexOfID(out, "mosquitto.server")
+	if seed == -1 || server == -1 {
+		t.Fatalf("a container was lost in rendering: seed=%d server=%d", seed, server)
+	}
+	if seed >= server {
+		t.Errorf("the run-once step rendered after the container it gates (seed=%d server=%d)", seed, server)
+	}
+	if once, _ := out[seed]["run-once"].(bool); !once {
+		t.Errorf("run-once did not reach the host declaration: %+v", out[seed])
+	}
+	if _, present := out[server]["run-once"]; present {
+		t.Errorf("run-once leaked onto the container that is not a step: %+v", out[server])
+	}
+}