AM-D3 path: the tool runner states its own fingerprint beside its capabilities

A capability reading must be tied to the runner that made it, so the grants
part can tell an older runner's reading from the running one's.

Builds: design 46 7 §6 (the announcement carries the runner's fingerprint), lead answer A-203 (key `fingerprint`)

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

node-tools/internal/runtime/announce_test.go

@@ -121,6 +121,7 @@ func TestTheRuntimeAnnouncesWhatItServesInTheServicesProtocol(t *testing.T) {
 // issue 1966 TLS-3 (ENG-2): the runner states the capabilities of the calls it answers in its PING, on its own instance, which
 // is what its machine's node-engine asks and takes into the node's record; no bundle is needed for it.
 func TestTheRunnerStatesTheCapabilitiesOfItsCallsInItsPing(t *testing.T) {
+	t.Setenv(FingerprintWord, "sha256:runner")
 	mesh := mt.New(t)
 	mesh.Issue(t, mt.MembershipOf("alpha", "anchor", false, nil))
 	nodeTools := connect(t, "node-tools", "anchor")
@@ -142,4 +143,8 @@ func TestTheRunnerStatesTheCapabilitiesOfItsCallsInItsPing(t *testing.T) {
 	if err := json.Unmarshal(msg.Data, &ping); err != nil || ping.Metadata[announce.Capabilities] != "approval-mark/1,bus-state-calls,ledger-calls,put-sessions,seat-settle-delay" {
 		t.Errorf("the runner states %q (%v), want its bus-state and ledger calls", ping.Metadata[announce.Capabilities], err)
 	}
+	// Its own fingerprint beside them (design 46 approval mark §6).
+	if ping.Metadata[announce.Fingerprint] != "sha256:runner" {
+		t.Errorf("the runner states its fingerprint as %q", ping.Metadata[announce.Fingerprint])
+	}
 }