A module's runtime waits for its broker credential and its account at a start, bounded, instead of exiting (issue 1496)

The node-engine starts a module's runtime before the provisioner's client fills
its broker file, and the bus carries a new account only after it reloads its
users. The runtime exited on both and was restarted until they were there (ace,
2026-10-26 21:19: mesh-build-node's and mesh-build-image's runtimes exited twice).
It now waits up to five minutes from its start, said once: the file is read again
each time its directory changes (the bundles' inotify watch, a 30 s backstop),
and an authorization refusal is asked again with the backoff. Past the bound it
gives up loudly; a file with no url, a pin mismatch and a bad URL stay final.

node-tools/internal/bus/bus.go

@@ -129,12 +129,19 @@ func Fatal(err error) string {
 		strings.Contains(msg, "nats: invalid url") {
 		return "the bus address is not a usable URL"
 	}
-	if regexp.MustCompile(`(?i)authorization violation|user authentication expired|permissions violation`).MatchString(msg) {
+	if Refused(err) || regexp.MustCompile(`(?i)user authentication expired|permissions violation`).MatchString(msg) {
 		return "the bus refused this account"
 	}
 	return ""
 }
 
+// Refused says whether the bus refused the account a connection named (an authorization violation): final for a running
+// runtime, but at a start possibly only "not yet", since the bus carries a new account after it reloads its users (issue
+// 1496). Fatal still names it; the caller decides how long a start waits.
+func Refused(err error) bool {
+	return err != nil && regexp.MustCompile(`(?i)authorization violation`).MatchString(err.Error())
+}
+
 func normalizeFingerprint(f string) string {
 	f = strings.TrimSpace(f)
 	if len(f) > 7 && strings.EqualFold(f[:7], "sha256:") {