Make a network on the spot, and say which one you just started

Two reports of the same shape: a network was left and came back after a
restart, and `network join` asked for a secret it could have invented.

The first was not a bug in leaving. The secret on the start command line
derives the network id, so a command line carrying the secret of a network
you have just left recreates it on the next start — which is right, it says
to join that network, but nothing on screen said so. `up` now marks the
network `· new` or `· already here`, and warns in full when another
configured network answers to the same name. A name is a label; the id is
the identity, and the secret is what decides which of them this is. Said at
the moment it happens it is obvious; discovered later in a status report it
is a mystery, which is exactly how it went.

The second was an omission: `up` had learned to invent a secret and
`network join` had not, so the quickest possible thing — a network with
somebody for as long as it is needed, then gone — still needed a secret
generated first. Both now resolve a bare name the same way: the one network
of that name this device already has, or a fresh random secret when there
is none. It is printed in full, with the single line the other person can
paste as it stands, endpoint id included, because a secret nobody can read
is a network nobody can join.

The id is printed in full by both answers now. The shortened form belongs in
a report, where it is read; this one gets copied into the next command.

Covered end to end against a running agent: joining with no secret prints a
secret and a pasteable command with a peer in it, and joining a name this
device already has resumes that network instead of making another that
merely looks the same.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -323,7 +323,7 @@ tsunagi id key rotate           replace that key
 
 tsunagi network                 the networks this device belongs to
 tsunagi network join -n lab -s tsn1…   join one; adds it to a running agent
-tsunagi network join -n lab     join one whose secret this device already has
+tsunagi network join -n lab     resume one this device has, or make it on the spot
 tsunagi network leave <id>      give up the address and name, then forget it
 tsunagi network secret          the secret of each joined network
 tsunagi network secret <id>     just that one, for copying
@@ -334,8 +334,8 @@ tsunagi dns on                  start it, now and after every restart
 tsunagi dns off                 stop it, now and after every restart
 ```
 
-**A network without a secret makes one.** `tsunagi up --network lab` with no
-`--secret` resolves in the obvious way: if this device is already in exactly
+**A network without a secret makes one.** `tsunagi up --network lab` and
+`tsunagi network join --network lab` both resolve a bare name the same way: if this device is already in exactly
 one network called `lab`, that one — so the name alone resumes what you have;
 if it is in none, a fresh random secret, printed in full along with the one
 line to send the others:
@@ -351,6 +351,13 @@ other machine:
   tsunagi up --network lab --secret tsn1u7c… --peer 91e83a6e2b7a…
 ```
 
+`up` says which of the two happened — `· new` or `· already here` beside
+the network — and warns when the name is one another configured network
+also answers to, because a name is a label and the id is the identity. A
+command line with a different secret makes a *different* network of the
+same name, and that is how a network you left comes back: the secret on the
+command line is what decides which network it is.
+
 That is the ad-hoc case: one person makes a network and sends the command
 round. The secret is printed *only* when the agent invented it — there is
 nowhere else to read it from — and never when it was supplied, because then