AM-D3 path: the tool runner states its own fingerprint beside its capabilities

A capability reading must be tied to the runner that made it, so the grants
part can tell an older runner's reading from the running one's.

Builds: design 46 7 §6 (the announcement carries the runner's fingerprint), lead answer A-203 (key `fingerprint`)

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

node-tools/internal/runtime/runtime.go

@@ -316,7 +316,10 @@ func Run(conn *bus.Conn, served []Served, envs map[string]map[string]string, log
 	announced, err := announce.Serve(conn, announce.Service{
 		Name: conn.Module(), ID: instanceOf(conn),
 		Description: "the mesh's tool runtime on " + node + ": every assigned module's tools and the seats they hold",
-		Metadata:    map[string]string{"node": node, announce.Capabilities: strings.Join(CallCapabilities(), ",")},
+		// Its own fingerprint beside the capabilities, so a reading is tied to the runner that made it (design 46 approval
+		// mark §6, lead answer A-203).
+		Metadata: map[string]string{"node": node, announce.Capabilities: strings.Join(CallCapabilities(), ","),
+			announce.Fingerprint: os.Getenv(FingerprintWord)},
 	}, func() []announce.Endpoint { return endpointsOf(conn, r.own(), r.registrations(), r.modules) })
 	if err != nil {
 		logf("[mesh-tools] cannot announce what it serves: %v", err)