records: the record is read where it is written

A module keeping a checkout of a repository of decisions, designs and issues from the git seat,
current on every announced merge and on a timer, answering records_search / records_read /
records_list / records_status / records_sync at the commit it read (novox/hq ADR 0025, ADR 0153).
The repository is a setting; it names no mesh.

modules/records/Dockerfile

@@ -0,0 +1,26 @@
+# records' runtime: the tool runtime, carrying this module's compiled reader and its tools.
+#
+# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
+# nothing is copied out of a neighbouring checkout (novox/hq ADR 0069).
+#
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/records
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc records.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+# **A module may need something the base image does not carry.** The reader keeps a checkout of the
+# repository it reads (novox/hq ADR 0153) — a git working copy, kept current, not a derived copy — and
+# the base image has no git. Certificates too, because the origin may be reached over TLS.
+RUN apt-get update \
+      && apt-get install -y --no-install-recommends git ca-certificates \
+      && rm -rf /var/lib/apt/lists/*
+COPY --from=build /app/modules/records/dist /app/modules/records/dist
+# Both entrypoints, loaded in serve mode: the consumer that pulls on a merge, and the tools.
+ENV MESH_TOOL_MODULES=/app/modules/records/dist/index.js,/app/modules/records/dist/tools/index.js