CAT-BN3: mesh-build-node publishes through the registry seats and holds no registry credential

Bundles go through oci-artifact-registry and answer the seat's reference;
a trunk package is packed under the builder's version and published through
npm-package-registry, so the holder can check it with the builder. Reads are
anonymous, so the write pair, the sealed secret and the store's address go.
The one-part sender moves into buildstep for both build modules, so the move
to the registry clients is made in one place.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/mesh-build-node/cmd/mesh-build-node/module.go

@@ -57,10 +57,9 @@ type Module struct {
 	Say func(format string, a ...any)
 	// HTTP reads and publishes to the package registry; a client of its own when nil. A test serves its own.
 	HTTP *http.Client
-	// RegistryFile holds the artifact store's address (host:port), placed by the manifest; Push puts a blob there
-	// (buildstep.PushBlob when nil; a test's fake store).
-	RegistryFile string
-	Push         func(ctx context.Context, registry, repository, digest string, body []byte) error
+	// Call asks a registry seat's verb over the bus, the publish of a done build (publish.go): stdio.Ask when nil; a
+	// test's fake holder.
+	Call buildstep.SeatCall
 	// Bubblewrap reads the installed bubblewrap's version (ProbeBubblewrap): a step is refused, and the module is
 	// unhealthy, while it is missing or older than BubblewrapLeast. Nil probes nothing.
 	Bubblewrap func(ctx context.Context) (string, error)