CAT-BN3: mesh-build-node publishes through the registry seats and holds no registry credential

Bundles go through oci-artifact-registry and answer the seat's reference;
a trunk package is packed under the builder's version and published through
npm-package-registry, so the holder can check it with the builder. Reads are
anonymous, so the write pair, the sealed secret and the store's address go.
The one-part sender moves into buildstep for both build modules, so the move
to the registry clients is made in one place.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/mesh-build-node/cmd/mesh-build-node/main.go

@@ -36,7 +36,7 @@ func main() {
 	}
 	paths := Paths{Home: home, Cache: CacheDir}
 	registry := func() (Registry, error) {
-		return ReadRegistry(filepath.Join(home, "package-registry.json"), filepath.Join(home, "package-registry.secret"))
+		return ReadRegistry(filepath.Join(home, "package-registry.json"))
 	}
 	m := &Module{
 		Node:                strings.TrimSpace(os.Getenv("MESH_NODE")),
@@ -55,7 +55,6 @@ func main() {
 		Ctx:                 ctx,
 		Say:                 logf,
 		Bubblewrap:          ProbeBubblewrap,
-		RegistryFile:        filepath.Join(home, "registry"),
 	}
 	m.Floor = floorOf(m.Node)
 	m.Settings = filepath.Join(home, "settings.json")