011: tools have a different audience, migrations cross the edge, provisioning is early

Three additions, and the third kills an assumption.

Tools are the most common content in the catalogue — 56 of 126 modules, more
than carry a service — and they survive the split without fitting either half. A
tool is not an artifact and not node state; it is a contract the mesh publishes
on a module's behalf, and what consumes it is an AGENT rather than another
module. That is a second audience the design has not described. Whether it is
one relation with two audiences or two relations is cheap to decide now and
expensive later.

A migration belongs to the CONSUMER and runs on the PROVIDER. A game's
migrations run against the database the store granted it: owned by the consumer,
hosted inside something it does not control, ordered after the provisioning edge
because there is nothing to migrate until the grant exists, and scoped to that
grant. Ownership crosses the edge, which nothing in provides and requires
expresses — and it gives a consumer's own install an internal order, provisioned
then migrated then started, that depends on an edge rather than on its contents.

And provisioning is EARLY, not late. The assumption worth killing is that it is
something the control plane does for consumers once a mesh is running. The
mesh's own registry database is provisioned before there is a mesh, and so is
its virtual host on the broker: the store runs from the carried bundle, a
database is created in it, the mesh's own schema is applied, and only then does
a control plane exist. Steps two and three happen before there is a mesh to do
them, so provisioning is part of the bootstrap and part of what the bundle has
to express.

Which strains ADR 0043. The host applies declared state ON THIS MACHINE, and a
database inside a running store is not a file or a unit. At bootstrap it is at
least local — the store is on the same machine. Afterwards a consumer on one
node provisioned from a store on another is the ordinary case and reaching it is
not the host's job. The same operation is local at bootstrap and remote later,
which is either two mechanisms or one with a tier boundary crossing inside it.
Currently the sharpest unresolved thing in the effort.

01-RESEARCH/011-the-module-graph/features.md

@@ -85,6 +85,23 @@ Nothing replaces it, because it was never one concept:
 | prerequisite-* | an **edge** in the graph | the catalogue |
 | verify, verifiers | the host's **read-back** | the host |
 
+## Tools are a facet, and their consumer is not a module
+
+The most common content in the catalogue: 56 of 126 modules carry a tool surface, more than
+carry a service.
+
+It survives the split, and it does not fit either half cleanly. A tool is not an artifact and
+not node state — it is a **contract the mesh publishes on a module's behalf**, and what consumes
+it is an **agent**, not another module.
+
+That is a second audience, and the design has only described one. A module `provides` things
+other modules require; a module also `provides` things agents call. Same word, different
+consumer, different lifecycle — a tool appears when the module is assigned somewhere and
+disappears when it is not, and nothing in the graph edges says so.
+
+Whether that is one relation with two audiences or two relations is undecided, and it is the
+kind of question that is cheap now and expensive later.
+
 ## What is lost, and should not be
 
 **Detection.** Features are detected from the directory rather than declared, and the reason is