compose: an offer of form none composes no credential and holds nothing

After the controller, nothing makes a pair row for a new consumer, so a need whose provider offers no credential
(form none) was composed with a stand-in on both ends and the node-engine held the consumer (issue 1126:
mesh-cli on ace, "stands in for the grant of mcp-endpoint"). The vault never mints for form none, so such a need
now composes with no credential: the consumer's need carries none, the provider's grant carries the consumer
and nothing sealed, neither is named foreseen, CredentialsNeeded asks the vault for neither, and no empty grant
file is written.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

go/compose/credentials.go

@@ -105,7 +105,12 @@ func (c *composer) grantsFor(node string) ([]catalogue.Grant, []catalogue.Overfl
 			}
 		}
 		sealed := s.ForProvider
-		if sealed == "" {
+		switch {
+		case credentiallessRow(plan, s, node):
+			// Its offer presents no credential (form none): the grant carries the consumer and nothing sealed, and
+			// nothing stands in for it, so neither end waits for a value nobody makes (issue 1126).
+			sealed = ""
+		case sealed == "":
 			sealed = catalogue.ForeseenSealed
 			foreseen = append(foreseen, fmt.Sprintf("the grant of %s for %s on %s", s.Provision, s.ConsumerModule, s.Consumer))
 		}
@@ -116,6 +121,18 @@ func (c *composer) grantsFor(node string) ([]catalogue.Grant, []catalogue.Overfl
 	return out, withheld, unbound, foreseen, nil
 }
 
+// credentialless is whether a need's provider offers it with no credential (catalogue.CredentialFormNone): the vault
+// mints nothing for it, so nothing is asked of the vault, sealed into a grant or a file, or stood in for (issue 1126).
+func credentialless(n catalogue.Needed) bool { return n.CredentialForm == catalogue.CredentialFormNone }
+
+// credentiallessRow is whether the consumer's resolution answers row's need from provider with an offer of form none.
+func credentiallessRow(consumer catalogue.Resolution, row Issued, provider string) bool {
+	return slices.ContainsFunc(consumer.Needs, func(n catalogue.Needed) bool {
+		return n.Name == row.Provision && n.For == row.ConsumerModule && n.Local == row.Local && n.From == provider &&
+			credentialless(n)
+	})
+}
+
 // rowsFor is every pair credential this node's declaration must carry a grant for, in the order the controller reads them
 // (SecretsFrom: by provision, consumer, consumer module and local name): the ones the Input says were made, and the ones the same send
 // would make before it composes this node -- every need of a node that resolves (this one too), whose provider is this node, that is not