Providers: broker-bound runtime container replaces the old provisioner (ADR 0052/0053)

Each provider's separate provisioner container becomes a runtime container that
serves the module's tools and runs its provisioner under the module's scoped broker
account: mesh-runtime-<module>, on the backend's own network (reaching the backend
by name and the broker by NAT), with MESH_BROKER_FILE + MESH_RECEIVES replacing
GRANTS. umami gains the broker own-secret it lacked. cloudflare-dns's adapter is
re-pointed at the ADR 0053 contract (a data provision, like umami — its record
return is the scoped-out concern).

Proven: provider-on-backend-network green — redis's runtime, on the private redis
network, binds the broker and provisions a consumer with the mesh's credential.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/cloudflare-dns/module.json

@@ -52,23 +52,26 @@
       "mode": "0600"
     },
     {
-      "id": "provisioner",
+      "id": "runtime",
       "type": "container",
-      "name": "mesh-provision-cloudflare-dns",
-      "image": "mesh-provision-cloudflare-dns@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "name": "mesh-cloudflare-dns",
+      "image": "mesh-runtime-cloudflare-dns@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "host",
-      "env": {
-        "GRANTS": "/grants",
-        "MESH_CLOUDFLARE_TOKEN_FILE": "/run/secrets/token",
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_CLOUDFLARE_CONFIG_FILE": "/run/config/config.json"
-      },
       "volumes": [
         "/var/lib/cloudflare-dns/config.json:/run/config/config.json:ro",
         "/var/lib/cloudflare-dns/grants:/grants",
         "/var/lib/cloudflare-dns/token:/run/secrets/token:ro",
         "/var/lib/mesh/cloudflare-dns/broker:/run/secrets/broker:ro"
-      ]
+      ],
+      "env": {
+        "MESH_CLOUDFLARE_TOKEN_FILE": "/run/secrets/token",
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_CLOUDFLARE_CONFIG_FILE": "/run/config/config.json",
+        "MESH_RECEIVES": "/var/lib/cloudflare-dns/grants/mesh.json"
+      }
     }
+  ],
+  "capabilities": [
+    "container-runtime"
   ]
 }