Refuse a held-back membership's old wrapper in the tool runner, pinning mesh-sdk's review-round-1 codec

The old grants part wrote its wrapper for a held-back membership too; the new part leaves such a key alone, and taking
it would serve what the hold kept back with the stream's copy ignored. The integration test now proves that copy is
served instead. Review round 1 of issue 774's fix.

node-tools/internal/bus/bus.go

@@ -470,8 +470,9 @@ func (c *Conn) followGrants(module string) {
 			return // a membership withdrawn is the stream's, or the module's unassignment's, to say
 		}
 		// Read through mesh-sdk's one codec of this state, the grants part's writer's (issue 774): it takes the bare
-		// membership and the wrapper the part wrote before, and refuses a value naming no node or module, which then
-		// leaves the assignments stream's copy in force instead of an empty membership.
+		// membership and a wrapper the part wrote before of one published or unchanged, and refuses a held-back one's
+		// wrapper or a value naming no node or module, which then leaves the assignments stream's copy in force instead.
+		// A refused value arriving after a good one keeps the last good membership: nothing here clears it.
 		var m Membership
 		body, err := membership.BareGrantsMembership(e.Value())
 		if err == nil {