place: the host — the lab acquires a consumer

The lab raised an underlay and put nothing on it: correct, and useless, because
the thing it exists to test did not exist. Tier 0 now does, so `place: [host]`
works and a raised scenario finally contains something.

The refusal narrows rather than disappearing. A scenario placing a host and a
substrate is told which half is missing, by name — not that `place:` is
unsupported when half of it now works.

Placement reads back rather than assuming. A file arriving is not a host
working, so the binary is run before it is trusted to answer questions, and what
it reports is read from the machine (ADR 0035). The binary comes from an
explicit path, because the declaration design leaves where artifacts come from
open and a search would harden into the answer by accident.

The integration test that matters is the one asserting the host reports the
MACHINE and not the workstation that placed it. A raised VM and this workstation
differ in every capability — root versus uid 1000, a clean init versus a
degraded one, no docker versus docker, no wireguard versus wg0 — so a host
reporting the wrong machine is obvious here and invisible anywhere else.

And the placed host independently confirms ADR 0031: overlay absent on a freshly
raised machine. The underlay suite already asserted that by looking for
wireguard interfaces; this is a second witness rather than the same check twice.

Two tests failed the moment placement worked, which is what they were for. They
defended "there is nothing to place yet" while that was true; the decision
changed, so they change with it rather than being deleted.

Gate: 75 unit, 20 integration.

README.md

@@ -116,16 +116,20 @@ than ignored:
 | `policy:` between segments | **works**, asymmetric |
 | `inbound: deny` | **works** — host firewall, read back after applying |
 | several public networks, routed not bridged | **works** — a transit router, never a shared bridge |
-| `place:` | **refused at raise** — the node host it would place does not exist yet |
+| `place: [host]` | **works** — tier 0 is placed and asked what the machine is |
+| `place:` anything above tier 0 | **refused, by name** — those tiers do not exist yet |
 
 `raise` refuses a scenario declaring anything in the lower half, naming every gap. It does not
 raise a mesh that silently lacks what it declared — that is the fault this lab exists to catch
 (`novox/hq` 04-ISSUES/003: a firewall key declared in five manifests and read by no code, so a
 manifest appears to restrict a port and restricts nothing).
 
-No scenario in `scenarios/` declares `place:` yet, so all of them raise. What they raise is
-an underlay holding empty machines — correct, and not yet useful for anything, because the
-node host that would be placed on them does not exist.
+`bootstrap-single.yml` places the host. The rest raise an underlay and put nothing on it,
+which is still correct for what they test.
+
+Placing needs a built host binary — set `MESH_LAB_HOST_BINARY` to one. It is an explicit path
+rather than a search on purpose: the declaration design leaves *where `place:` gets its
+artifacts from* open, and guessing would harden into the answer by accident.
 
 ## Measured on a workstation