CAT-D3: distribution's mirror copies an outside image by its pinned digest into upstream/<host>/<path>

Until now mirror only answered a copy the store already held, so mesh-build-image had nothing to call for an upstream
base (design 51: an upstream image is copied by mirror with its pinned digest). The copy takes an anonymous pull
token, checks every manifest's and blob's bytes against its digest, copies an index's every platform first, and
fetches only the blobs the store lacks. tags was already served.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/cmd/distribution-tools/main.go

@@ -208,7 +208,7 @@ func tools(v *holder.Verbs, windows kept[holder.Window]) []stdio.Tool {
 			Run: func(args map[string]any) (any, error) {
 				return v.Tags(holder.ImageSeat, stdio.CallerOf(args), str(args, "name"))
 			}},
-		stdio.Tool{Name: holder.ImageSeat + "." + holder.VerbMirror, Description: "Where the store holds a copy of an outside image, by its pinned digest (mesh-build-image alone).",
+		stdio.Tool{Name: holder.ImageSeat + "." + holder.VerbMirror, Description: "Copy an outside image, pinned by its digest, into the store as upstream/<host>/<path> (every platform, only the parts it lacks) and answer its reference; says published (mesh-build-image alone).",
 			Input: obj(map[string]any{"source": s("<host>/<path>"), "digest": s("sha256:…")}, "source", "digest"),
 			Run: func(args map[string]any) (any, error) {
 				r, err := arg[holder.MirrorRequest](args)
@@ -286,7 +286,7 @@ func main() {
 		os.Exit(1)
 	}
 	base, _ := url.Parse("http://127.0.0.1:5001")
-	store := &holder.OCI{Base: base, Registry: os.Getenv("MESH_REGISTRY_REACH")}
+	store := &holder.OCI{Base: base, Registry: os.Getenv("MESH_REGISTRY_REACH"), Upstream: &holder.Upstream{}}
 	h := &holder.Holder{Callers: callers, Objects: objects{}, Builder: builderVersions{}, Store: store, Say: say, Finding: finding,
 		Transfers: kept[holder.Transfer]{state: holder.TransfersState, key: func(t holder.Transfer) string { return t.Transfer }}}
 	v := &holder.Verbs{Holder: h, Catalog: store, Holds: kept[holder.Hold]{state: "holds", key: holder.Hold.Key}}