fix/phase-1-d8-grant-and-d10-version
main
The controller now composes a publish grant for mesh.seat.node-intrusion-prevention.tool.banned.*, which D8 asks every machine; the installer's first user list must say what the controller derives, or a new mesh's first self-check is refused it.