CAT-BN3: mesh-build-node publishes through the registry seats and holds no registry credential

Bundles go through oci-artifact-registry and answer the seat's reference;
a trunk package is packed under the builder's version and published through
npm-package-registry, so the holder can check it with the builder. Reads are
anonymous, so the write pair, the sealed secret and the store's address go.
The one-part sender moves into buildstep for both build modules, so the move
to the registry clients is made in one place.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/mesh-build-node/cmd/mesh-build-node/isolate.go

@@ -2,7 +2,7 @@ package main
 
 // The run steps shut off (novox/hq ADR 0448; issue 1309, lead decision L2 of R4e): the type-check, the package's test
 // script, tsc and esbuild run the change's code, so each runs through mesh-sdk's buildstep.Isolated, in bubblewrap: no
-// network, none of the account (its home, its ssh key, its registry secret, its bus login, the runtime directory), the
+// network, none of the account (its home, its ssh key, its bus login, the runtime directory), the
 // workspace read-write, the toolchain read-only, the shared npm cache read-only beneath a throwaway writable layer, or
 // read-write for a trunk build alone (publish). The fetch step (git, npm ci of the module's own packages) holds the key
 // and the network and runs none of the change's code, so it runs as before.