bus: tester identity for PM tests (row 110, #1604)

A tester binds with a process proof from the bus's own tester-cli.mjs
when the business var bus.tester is true. It may send [mos test] messages
to a role, receive replies on the tester address and use the read verbs;
every other verb refuses. Messages store from_role tester and write no
human.input event. turnRequest() marks them as never Jason's instruction.
human.mjs is unchanged.

Candidate manifest bdaf7f476abd0b2b5095ab2f7f43e38540e6ba48ee14a02a4f4995a1469b79df
(Darkwing round 2, packet 9f1563ec1), BASE badfa52b9. Approved by Filbert
(comment 28360) and Sage (comment 28361). Sage gate rerun passed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/cli/README.md

@@ -80,6 +80,16 @@ mosaic launches list [--json]
   the bus (see "Sessions" below). `stop` refuses inside an agent run;
   `launches list` does not, because the file is readable to the same user
   anyway.
+- `--tester` (row 110, #1604) runs `inbox`, `tasks`, `agents`, `trail`,
+  `talk` and `follow` as the business's tester through
+  `packages/bus/src/tester-cli.mjs` instead of as the human. It is the one
+  exception to the agent check above: Mos or a T3 seat may run it for a PM
+  test, and the broker still refuses it under a managed run
+  (`tester-required`) or while the business var `bus.tester` isn't `true`
+  (`tester-off`), each exit 3. `talk --tester` text must start with
+  `[mos test]`, else exit 2 before any call. The role's reply comes back to
+  the tester, not to the human's inbox. `decide`, `stop` and `launches`
+  take no `--tester` (exit 4).
 
 ## The app