Function narrow 

pub fn narrow(
    working: MeshConfig,
    trunk: &MeshConfig,
) -> (MeshConfig, Vec<String>)

The working tree’s declaration with every widening of trunk removed, and a line for each.

use majordomus_cli::mesh::root::narrow;
use majordomus_cli::mesh::MeshConfig;
let parse = |v: serde_json::Value| MeshConfig::from_metadata(&v, "x").unwrap();
let trunk = parse(serde_json::json!({
    "schema": "mesh/v1", "kind": "mesh-declaration", "id": "x", "enabled": true,
    "trust": { "policy": "deny_unknown", "allow": ["aa"] },
}));
let branch = parse(serde_json::json!({
    "schema": "mesh/v1", "kind": "mesh-declaration", "id": "x", "enabled": true,
    "trust": { "policy": "tofu", "allow": ["aa", "bb"] },
    "rendezvous": { "endpoints": ["http://198.51.100.7:8791"] },
}));
let (held, narrowed) = narrow(branch, &trunk);
assert_eq!(held.trust.allow, vec!["aa".to_string()]);
assert_eq!(held.trust.policy, trunk.trust.policy);
assert!(held.rendezvous.endpoints.is_empty());
assert_eq!(narrowed.len(), 3, "{narrowed:?}");
// narrowing is always admitted: a branch that trusts less is obeyed as it is
let (same, none) = narrow(trunk.clone(), &trunk);
assert!(none.is_empty() && same.trust.allow == trunk.trust.allow);