Ten migration-critical modules become mesh-buildable (issue 060)

keycloak, mailu, minio, mongodb, mssql, nextcloud, portainer, redis,
umami and verdaccio get the Dockerfile + build section the eight
buildable modules already had; their runtime containers name the
artifact instead of a placeholder digest.

One convention, settled (060's open question, informed by 061): the
runtime container runs serve mode with every serve-time entrypoint in
MESH_TOOL_MODULES — tools serve, events flow, and a provider's
provisioner reconciles in the same process with the broker connected.
postgres, gitea and lavinmq are retrofitted from args-run provisioners,
which served no tools and emitted lifecycle events nowhere.

route-proxy is deferred: its build context is the mesh-controller
repository, a cross-repo shape the build section cannot yet express.

modules/portainer/module.json

@@ -51,7 +51,6 @@
       "id": "runtime",
       "type": "container",
       "name": "mesh-portainer",
-      "image": "mesh-runtime-portainer@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "host",
       "volumes": [
         "/var/lib/mesh/portainer/broker:/run/secrets/broker:ro",
@@ -64,10 +63,32 @@
       },
       "restart-on": [
         "runtime-config"
-      ]
+      ],
+      "artifact": "runtime"
     }
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/portainer/broker"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
   }
 }