CAT-BN3: mesh-build-node publishes through the registry seats and holds no registry credential

Bundles go through oci-artifact-registry and answer the seat's reference;
a trunk package is packed under the builder's version and published through
npm-package-registry, so the holder can check it with the builder. Reads are
anonymous, so the write pair, the sealed secret and the store's address go.
The one-part sender moves into buildstep for both build modules, so the move
to the registry clients is made in one place.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/mesh-build-node/module.json

@@ -63,20 +63,17 @@
     "forge-account",
     "npm-package-registry",
     "node-toolchain",
-    "artifact-store",
     "node-tools"
   ],
-  "contributes": {
-    "npm-package-registry": {
-      "access": "write"
-    }
-  },
   "binds": {
     "npm-package-registry": "${dir:state}/package-registry.json"
   },
-  "secrets": {
-    "npm-package-registry": "${dir:state}/package-registry.secret"
-  },
+  "invokes": [
+    "seat:oci-artifact-registry.publish",
+    "seat:oci-artifact-registry.publish-part",
+    "seat:npm-package-registry.publish",
+    "seat:npm-package-registry.publish-part"
+  ],
   "own-secrets": {
     "broker": "${dir:state}/broker"
   },
@@ -164,14 +161,6 @@
       "mode": "0644",
       "template": "files/gitconfig"
     },
-    {
-      "id": "registry",
-      "type": "file",
-      "path": "${dir:state}/registry",
-      "owner": "mesh-build-node",
-      "mode": "0644",
-      "template": "files/registry"
-    },
     {
       "id": "toolchain-dir",
       "type": "archive",