The node-engine's live path holds a module whose claim or credential fails (issue 1966, review round 1)

compose.CompositionsHolding returns the modules the declaration leaves out for a claim that cannot be held or a refused
credential; frombus composeEach holds each with those words, so the node-engine keeps what it handed of the module (no
stop of a running module), the candidate answer and the check's sandbox name it refused, and the rest composes.
CredentialsNeeded asks nothing for a held module. Resolve and checkClaims move to a test helper (production uses
ResolveHolding and holdClaims); a pass refused anyway names a held module's reason among the others.

Quick fix: Declared.Held read in the composer only. Thorough, chosen: the same held words reach every reader of the
composition (selfcompose, ComposeSent, the candidate answer) through composeEach's one hold path.

Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5

internal/compose/credentials_needed.go

@@ -23,12 +23,12 @@ type CredentialKey struct {
 // in neither list: the vault mints nothing for it (issue 1126).
 func CredentialsNeeded(in Input, node string) (asConsumer, asProvider []CredentialKey, err error) {
 	c := newComposer(in)
-	resolved, _, err := c.resolutionHolding(node)
+	resolved, held, err := c.resolutionHolding(node)
 	if err != nil {
 		return nil, nil, err
 	}
 	for _, n := range resolved.Needs {
-		if n.ByRecord || n.From == "" || credentialless(n) {
+		if _, isHeld := held[n.For]; isHeld || n.ByRecord || n.From == "" || credentialless(n) {
 			continue
 		}
 		asConsumer = append(asConsumer, CredentialKey{Provision: n.Name, Consumer: node, ConsumerModule: n.For,