Providers: broker-bound runtime container replaces the old provisioner (ADR 0052/0053)

Each provider's separate provisioner container becomes a runtime container that
serves the module's tools and runs its provisioner under the module's scoped broker
account: mesh-runtime-<module>, on the backend's own network (reaching the backend
by name and the broker by NAT), with MESH_BROKER_FILE + MESH_RECEIVES replacing
GRANTS. umami gains the broker own-secret it lacked. cloudflare-dns's adapter is
re-pointed at the ADR 0053 contract (a data provision, like umami — its record
return is the scoped-out concern).

Proven: provider-on-backend-network green — redis's runtime, on the private redis
network, binds the broker and provisions a consumer with the mesh's credential.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/umami/module.json

@@ -4,7 +4,6 @@
   "capabilities": [
     "container-runtime"
   ],
-
   "requires": [
     "postgres-database"
   ],
@@ -19,7 +18,6 @@
   "secrets": {
     "postgres-database": "/var/lib/umami/database.secret"
   },
-
   "provides": [
     {
       "name": "analytics",
@@ -35,12 +33,11 @@
   "grants": {
     "analytics": "/var/lib/umami/grants"
   },
-
   "own-secrets": {
     "app-secret": "/var/lib/umami/app.secret",
-    "admin": "/var/lib/umami/admin.secret"
+    "admin": "/var/lib/umami/admin.secret",
+    "broker": "/var/lib/mesh/umami/broker"
   },
-
   "listens": [
     {
       "port": 3000,
@@ -49,8 +46,13 @@
       "why": "one port serves two surfaces: the dashboard (the proxy gates it to the mesh) and the public collection endpoint that the browsers of every tracked site POST to — so the port itself must be reachable from anywhere"
     }
   ],
-
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/umami",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",
@@ -96,17 +98,22 @@
       ]
     },
     {
-      "id": "provisioner",
+      "id": "runtime",
       "type": "container",
-      "name": "mesh-provision-umami-analytics",
-      "image": "mesh-provision-umami-analytics@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "name": "mesh-umami",
+      "image": "mesh-runtime-umami@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "umami",
-      "env-file": [
-        "/var/lib/umami/provisioner.env"
-      ],
       "volumes": [
+        "/var/lib/mesh/umami/broker:/run/secrets/broker:ro",
         "/var/lib/umami/grants:/var/lib/umami/grants",
         "/var/lib/umami/admin.secret:/run/secrets/admin:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_RECEIVES": "/var/lib/umami/grants/mesh.json"
+      },
+      "env-file": [
+        "/var/lib/umami/provisioner.env"
       ]
     }
   ]