Merge main, and close what the confirmation review found (hq ADR 0272)

- Any failure of a request the link may have delivered now says the line
  may have run; "nothing ran" is said only of a request the link knows it
  never asked (no link open, nobody listening: link.ErrNotAsked).
- A test holds that a connection saying nothing is answered within its
  deadline, set at accept, and gives its slot back.
- The README says the socket refuses a process outside the machine's own
  namespaces, so flatpak, toolbox and distrobox shells are refused.

internal/meshcli/meshcli.go

@@ -42,8 +42,8 @@ type Asked struct {
 type Forward func(ctx context.Context, asked Asked) cli.Answer
 
 // readWithin bounds how long a connection may take to say its line: a program that connects and says nothing
-// holds nothing for long.
-const readWithin = 30 * time.Second
+// holds nothing for long. A variable so a test need not wait.
+var readWithin = 30 * time.Second
 
 // atOnce bounds how many lines are asked at the same time, and perAccount how many of them one account's: a person
 // types one at a time, so more is a program on the machine. One over either bound is answered busy at once — the