Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk
carries no composition rule. The catalogue functions only the
node-engine's composition reaches (Resolve, Resolution's Compose,
Declaration, DataItems, LeftOut, Rules and the rest, the settings,
placeholder and template refusals, the rendering helpers) are copied
with their tests into internal/compose/resolution; a method of a
mesh-sdk shape becomes a function taking it first. The composition
calls its own copies, and the captured catalogue its tests read lives
here now, shared by mesh-compose's tests.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

testdata/beside/mesh-catalog/modules/mesh-vault/module.json.captured

@@ -0,0 +1,173 @@
+{
+  "module": "mesh-vault",
+  "version": "1",
+  "runs-as": "mesh-vault",
+  "provides": [
+    {
+      "name": "secret",
+      "scope": "mesh",
+      "identity": {
+        "in": "a vault entry"
+      }
+    }
+  ],
+  "emits": [
+    "provisioned",
+    "rotated",
+    "secret-changed"
+  ],
+  "reads": [
+    "mesh-controller.assignments"
+  ],
+  "receives": {
+    "secret": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "secret": "${dir:grants}"
+  },
+  "keeps": "/var/lib/mesh-vault/root",
+  "data": {
+    "own": [
+      {
+        "id": "state",
+        "path": "${dir:state}",
+        "class": "valuable",
+        "why": "the vault's own keys"
+      },
+      {
+        "id": "ledger",
+        "path": "${dir:ledger}",
+        "class": "valuable",
+        "why": "every secret the vault keeps"
+      },
+      {
+        "id": "root",
+        "path": "${dir:root}",
+        "class": "valuable",
+        "why": "the vault's root material"
+      },
+      {
+        "id": "store",
+        "path": "${dir:store}",
+        "class": "valuable",
+        "why": "every secret the vault holds, sealed to its own key and to the operator key"
+      }
+    ],
+    "consumers": {
+      "secret": {
+        "class": "valuable",
+        "in": "ledger",
+        "why": "a secret given to a consumer is kept nowhere else in the clear"
+      }
+    }
+  },
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-vault",
+  "runtime-health": {
+    "kind": "tool",
+    "tool": "vault_health",
+    "interval": "60s",
+    "timeout": "10s",
+    "looks": 2,
+    "grace": "60s"
+  },
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-vault",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-vault"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
+    },
+    {
+      "id": "ledger",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
+    },
+    {
+      "id": "root",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
+    },
+    {
+      "id": "store",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-vault",
+        "binary": "mesh-vault",
+        "loads": [
+          "mesh-vault"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_VAULT_LEDGER": "${dir:ledger}",
+          "MESH_VAULT_ROOT": "${dir:root}",
+          "MESH_VAULT_STORE": "${dir:store}",
+          "MESH_VAULT_STATE": "${dir:state}"
+        }
+      }
+    ]
+  },
+  "tools": [
+    "secret_export",
+    "secret_holders",
+    "secret_verify",
+    "secret_handed",
+    "secret_asks",
+    "secret_vault_export",
+    "provisioner_retirement",
+    "provisioner_retire_approve",
+    "provisioner_retire_reject",
+    "provisioner_delete",
+    "vault_status",
+    "vault_health"
+  ],
+  "claims": [
+    {
+      "name": "mesh-vault",
+      "scope": "mesh",
+      "serves": [
+        "get",
+        "accept",
+        "secret-ask",
+        "issued",
+        "rotate",
+        "move-in",
+        "node-key",
+        "move-asks"
+      ]
+    }
+  ]
+}