bus: tester identity for PM tests (row 110, #1604)

A tester binds with a process proof from the bus's own tester-cli.mjs
when the business var bus.tester is true. It may send [mos test] messages
to a role, receive replies on the tester address and use the read verbs;
every other verb refuses. Messages store from_role tester and write no
human.input event. turnRequest() marks them as never Jason's instruction.
human.mjs is unchanged.

Candidate manifest bdaf7f476abd0b2b5095ab2f7f43e38540e6ba48ee14a02a4f4995a1469b79df
(Darkwing round 2, packet 9f1563ec1), BASE badfa52b9. Approved by Filbert
(comment 28360) and Sage (comment 28361). Sage gate rerun passed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/cli/src/transport.mjs

@@ -10,6 +10,7 @@ import { fileURLToPath } from "node:url";
 import { CliError } from "./errors.mjs";
 
 export const HUMAN_CLI = fileURLToPath(new URL("../../bus/src/human-cli.mjs", import.meta.url));
+export const TESTER_CLI = fileURLToPath(new URL("../../bus/src/tester-cli.mjs", import.meta.url));
 
 // The broker's markers (packages/bus/src/human.mjs). The broker checks the
 // whole ancestry; this check is only the clear early message for the case
@@ -37,6 +38,9 @@ const EXIT = {
   unauthenticated: 3,
   "unknown-business": 3,
   "read-only": 3,
+  "tester-required": 3,
+  "tester-off": 3,
+  "tester-refused": 3,
   "outcome-unknown": 1,
   "response-too-large": 1,
   "invalid-response": 1,
@@ -73,3 +77,11 @@ export function humanTransport({ socket, business, env = process.env, cli = HUMA
     }
   };
 }
+
+// Row 110 (#1604): the tester's transport is the same exchange through
+// tester-cli.mjs. It makes no agent check of its own: a tester runs from
+// inside Mos or a T3 seat, and the broker refuses one under a managed run or
+// while the business's bus.tester is off.
+export function testerTransport(options) {
+  return humanTransport({ cli: TESTER_CLI, ...options });
+}