Ten migration-critical modules become mesh-buildable (issue 060)

keycloak, mailu, minio, mongodb, mssql, nextcloud, portainer, redis,
umami and verdaccio get the Dockerfile + build section the eight
buildable modules already had; their runtime containers name the
artifact instead of a placeholder digest.

One convention, settled (060's open question, informed by 061): the
runtime container runs serve mode with every serve-time entrypoint in
MESH_TOOL_MODULES — tools serve, events flow, and a provider's
provisioner reconciles in the same process with the broker connected.
postgres, gitea and lavinmq are retrofitted from args-run provisioners,
which served no tools and emitted lifecycle events nowhere.

route-proxy is deferred: its build context is the mesh-controller
repository, a cross-repo shape the build section cannot yet express.

modules/redis/module.json

@@ -101,7 +101,6 @@
       "id": "runtime",
       "type": "container",
       "name": "mesh-redis",
-      "image": "mesh-runtime-redis@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "redis",
       "volumes": [
         "/var/lib/mesh/redis/broker:/run/secrets/broker:ro",
@@ -113,7 +112,29 @@
         "MESH_RECEIVES": "/var/lib/redis-module/grants/mesh.json",
         "MESH_PROVISION_REDIS": "redis:6379",
         "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/default"
-      }
+      },
+      "artifact": "runtime"
     }
-  ]
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
 }