"That could not be sealed." lives in one module, read by the backup destination and the mirror #5615

For: A destination or mirror credential that cannot be sealed reads the same wherever it is said, on the web and in the terminal, because it is said from one place. Today each sentence below is typed out separately in src/actions/destination.ts, src/actions/mirror.ts.

Done:

• [ ] src/kernel/seal_words.ts exports these sentences (new, or the module that already owns that concept; say which in the pull):

- "That could not be sealed."

• [ ] Every file named imports them, and grep -rn for each sentence under src/ finds only the module.
• [ ] Pages, screens and answers are byte-for-byte unchanged: every existing test passes as it is.
• [ ] A new test/seal-words.test.ts asserts each file named no longer contains the literal (read as text), and fails if a copy is typed back.
• [ ] Before pushing, run test/seal-words.test.ts, the tests of the files you touched, bun x tsc --noEmit and, if src/web changed, bun scripts/design-lint.ts. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/kernel/seal_words.ts, src/actions/destination.ts, src/actions/mirror.ts, test/seal-words.test.ts. Risk: a pure move; change no wording, and touch only the lines the sentences are on.