Beds for the seed file and for the foundation's filter

The vault bed grows into a create-once file and pushes again; the genesis bed
probes the machine from the workstation for the whole install and asserts the
store's port never answers while the bus's does.

test/integration/assigned-vault.test.ts

@@ -433,3 +433,33 @@ test("the operator recovers a root secret with a key the mesh never held, from t
   assert.ok(listed.some((k) => k.module === "mesh-vault" && k.name === "broker"), JSON.stringify(served));
   assert.ok(!JSON.stringify(served).includes(onDisk), "secret_export returned a plaintext value");
 });
+
+test("a seeded file is created once, and what a program grows in it survives the next push", {
+  skip, timeout: 600_000,
+}, async () => {
+  // novox/hq ADR 0087, issue 035. A file that says create-once is written when absent and left
+  // alone when present — content, mode and owner — so an access list a program persists into is
+  // not restored to its seed behind the program's back on every reconcile.
+  const manifest = JSON.stringify({
+    module: "seed-test", version: "1",
+    resources: [
+      { id: "dir", type: "directory", path: "/var/lib/seed-test", mode: "0755" },
+      { id: "acl", type: "file", path: "/var/lib/seed-test/acl.conf", mode: "0600", "create-once": true,
+        content: "user default on\n" },
+    ],
+  });
+  await must(`printf %s ${quote(manifest)} > /tmp/seed-test.json && docker cp /tmp/seed-test.json mesh-controller:/seed-test.json`);
+  await mesh("module add /seed-test.json");
+  await mesh(`assign ${MACHINE} seed-test`);
+  await mesh(`push ${MACHINE}`);
+  await settled();
+  assert.equal(await must(`cat /var/lib/seed-test/acl.conf`), "user default on\n");
+
+  // The program grows it.
+  await must(`printf 'user app-one on >secret\n' >> /var/lib/seed-test/acl.conf`);
+  // A second push: the mesh reconciles everything it declared, and leaves the seed alone.
+  await mesh(`push ${MACHINE}`);
+  await settled();
+  assert.equal(await must(`cat /var/lib/seed-test/acl.conf`), "user default on\nuser app-one on >secret\n",
+    "the seed was restored and what the program wrote into it was wiped");
+});