Providers: broker-bound runtime container replaces the old provisioner (ADR 0052/0053)

Each provider's separate provisioner container becomes a runtime container that
serves the module's tools and runs its provisioner under the module's scoped broker
account: mesh-runtime-<module>, on the backend's own network (reaching the backend
by name and the broker by NAT), with MESH_BROKER_FILE + MESH_RECEIVES replacing
GRANTS. umami gains the broker own-secret it lacked. cloudflare-dns's adapter is
re-pointed at the ADR 0053 contract (a data provision, like umami — its record
return is the scoped-out concern).

Proven: provider-on-backend-network green — redis's runtime, on the private redis
network, binds the broker and provisions a consumer with the mesh's credential.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/redis/module.json

@@ -96,20 +96,22 @@
       ]
     },
     {
-      "id": "provisioner",
+      "id": "runtime",
       "type": "container",
-      "name": "mesh-provision-redis",
-      "image": "mesh-provision-redis@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "name": "mesh-redis",
+      "image": "mesh-runtime-redis@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "redis",
-      "env": {
-        "GRANTS": "/var/lib/redis-module/grants",
-        "MESH_PROVISION_REDIS": "redis:6379",
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/default"
-      },
       "volumes": [
+        "/var/lib/mesh/redis/broker:/run/secrets/broker:ro",
         "/var/lib/redis-module/grants:/var/lib/redis-module/grants:ro",
         "/var/lib/redis-module/default.secret:/run/secrets/default:ro"
-      ]
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_RECEIVES": "/var/lib/redis-module/grants/mesh.json",
+        "MESH_PROVISION_REDIS": "redis:6379",
+        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/default"
+      }
     }
   ]
 }