row 175 (#1673): tester reads, W1-W7 writes recorded as tester, human-only verbs refuse tester-refused

TESTER_VERBS gains usage, names, limits, plugins, instances, project.list,
thread.list, name.set and project.create; TESTER_ORGANIZATION_VERBS lets a
tester read limits, plugins and instances and send plugins.set,
instances.set and routes.set, each logged with actor tester. The project
file verbs refuse a tester tester-refused. The broker and CLI drop the
[mos test] prefix rule (mos-0872 Q1). The CLI takes --tester on the seven
reads and the W1-W7 write forms and refuses it (exit 4) elsewhere.
project init --tester checks the project area, binds the tester with one
agents read, then commits the layout as tester (mos-0872 Q2).

docs/TOOLS.md

@@ -277,7 +277,8 @@ scripts/bus-service.sh uninstall | status <business>
 
 The human commands read and resolve through the broker's human transport
 (`packages/bus/src/human-cli.mjs`), never the SQLite file. They refuse inside
-an agent run. `bus start` is the host the systemd user unit
+an agent run, except the forms that take `--tester` (rows 110 and 175), which
+run as the business's tester; `packages/cli/README.md` lists them. `bus start` is the host the systemd user unit
 `mosaic-bus@<business>` runs. It boots the broker, starts the Discord
 notifier, and needs `<dataRoot>/notify/<business>/notify.json`. That
 directory must be 0700: it also holds the notifier's journal `sent.jsonl`