Let node-tools' provider helper read mesh-provisioner's provisions and plans by mesh-sdk's names, so the runtime follows ADR 0570's records off the controller (issue 1954 L6-T1)

Pins mesh-sdk 4a96793 (go/provisions). The assignments read stays while the
sdk's helper still reads plans there (until L6-P3). A watch's expire now
reads as a removed key.

node-tools/internal/provide/provide_test.go

@@ -7,6 +7,9 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/provider"
+	"git.novox.be/novox/mesh-sdk/go/provisions"
+
 	"github.com/novox/mesh-tools/node-tools/internal/bus"
 	mt "github.com/novox/mesh-tools/node-tools/internal/meshtest"
 )
@@ -102,6 +105,8 @@ func TestTheOfferServesThePortTheManifestServes(t *testing.T) {
 	var m struct {
 		Serves   map[string]map[string]any `json:"serves"`
 		Moved    bool                      `json:"moved"`
+		State    []string                  `json:"state"`
+		Reads    []string                  `json:"reads"`
 		Provides []struct {
 			Name       string `json:"name"`
 			AnsweredBy string `json:"answered-by"`
@@ -138,6 +143,23 @@ func TestTheOfferServesThePortTheManifestServes(t *testing.T) {
 			t.Errorf("the build still carries %+v, which only a moved module needs", a)
 		}
 	}
+	// Every bucket the sdk's helper reaches is a state the manifest keeps or reads, by the sdk's names: the provider's
+	// own, the seat mesh-provisioner's provisions and plans (issue 1954 L6-T1), and the assignments the helper still reads.
+	declared := map[string]bool{}
+	for _, n := range append(m.State, m.Reads...) {
+		declared[n] = true
+	}
+	for bucket, want := range map[string]string{
+		provider.BucketOf(Module):   "bound",
+		provisions.ProvisionsBucket: "mesh-provisioner.provisions",
+		provisions.PlansBucket:      "mesh-provisioner.plans",
+		provider.AssignmentsBucket:  "mesh-controller.assignments",
+	} {
+		got, err := (busOf{}).state(bucket)
+		if err != nil || got != want || !declared[got] {
+			t.Errorf("the helper's bucket %s reaches state %q (%v), want %q declared in the manifest", bucket, got, err, want)
+		}
+	}
 }
 
 // Only the machine's runtime is the provider: a process on another credential, or with no machine, answers nobody.