Let a node composing itself hand a module exactly when the vault judged its plan handed, through one rule (catalogue.AssignmentHands), so the vault and the node never judge postgres's secrets two ways again (issue 774)

go/compose/render.go

@@ -65,7 +65,7 @@ func (c *composer) render(nodeName string, mode Mode) (Rendered, error) {
 	}
 
 	// And each module's own secrets: a module handed to the provisioner has its secrets from the vault through the client.
-	handing := catalogue.Rendering{Hands: r.Hands, Provisioner: r.Provisioner}
+	handing := catalogue.Rendering{Hands: r.Hands, Provisioner: r.Provisioner, Assigned: r.Assigned}
 	needed, foreseenOwn, err := c.ownSecretsFor(node, plan, handing, mode)
 	if err != nil {
 		return Rendered{}, err