Route a call key naming its machine after '@', and refuse a malformed key before publishing

The lease write asked seat:node-service-manager.stop@novox-be through Conn.Call, which published
the '@' inside the subject: nobody served it and the call timed out after 30 s with nothing said
(issue 774 notes 84-87). Every key now parses in one place, calladdress: Call routes '@node' as
CallOn does, and stdio Ask refuses a key the runtime could not route, before anything is sent.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

go/stdio.go

@@ -24,6 +24,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/calladdress"
 )
 
 // Protocol is the MCP version this speaks; the runtime says the same.
@@ -471,8 +473,12 @@ func Subscribe(pattern string, handle func(Envelope) error) error {
 }
 
 // Ask calls a tool on the mesh as this bundle's module, through the runtime (ADR 0198), and returns
-// its result as JSON. The key is `<module>.<tool>` as the runtime calls it.
+// its result as JSON. The key is `<module>.<tool>` or `seat:<seat>.<verb>`, with `@<node>` for one machine's, as the
+// runtime calls it; a malformed key is refused here, before the runtime is asked (calladdress; novox/hq issue 774).
 func Ask(key string, body any) (json.RawMessage, error) {
+	if err := calladdress.CheckOwn(key); err != nil {
+		return nil, err
+	}
 	c, err := live()
 	if err != nil {
 		return nil, err