Run the bus from its pinned upstream image with the snapshot program and the entrypoint mounted, and write and rehearse the way there and back (issues 1640, 1641, 1642, ADR 0480 clauses 1-3, 5, 6, 11)

modules/nats/module.json

@@ -57,7 +57,7 @@
         "class": "valuable",
         "active": "1d",
         "backup": {
-          "dump": "docker exec -i mesh-broker-nats mesh-nats-snapshot snapshot < ${dir:mesh-state}/broker > ${dir:snapshots}/bus.tar.partial && mv ${dir:snapshots}/bus.tar.partial ${dir:snapshots}/bus.tar || { rm -f ${dir:snapshots}/bus.tar.partial; exit 1; }",
+          "dump": "docker exec -i mesh-broker-nats /opt/mesh/mesh-nats-snapshot snapshot < ${dir:mesh-state}/broker > ${dir:snapshots}/bus.tar.partial && mv ${dir:snapshots}/bus.tar.partial ${dir:snapshots}/bus.tar || { rm -f ${dir:snapshots}/bus.tar.partial; exit 1; }",
           "into": "snapshots"
         },
         "why": "the bus's streams and key-value buckets: the hand-act log, conditions, every module's state; written all the time, so copied by the server's own snapshot of each stream (novox/hq ADR 0235), never as live files"
@@ -105,6 +105,20 @@
       "template": "files/nats.conf",
       "mode": "0644"
     },
+    {
+      "id": "program-snapshot",
+      "type": "archive",
+      "path": "/var/lib/nats-module/snapshot",
+      "artifact": "snapshot",
+      "unknown": "program"
+    },
+    {
+      "id": "program-entrypoint",
+      "type": "archive",
+      "path": "/var/lib/nats-module/entrypoint",
+      "artifact": "entrypoint",
+      "unknown": "program"
+    },
     {
       "id": "server",
       "type": "container",
@@ -116,9 +130,19 @@
       "volumes": [
         "/var/lib/mesh-broker-nats:/data",
         "/var/lib/nats-module/conf:/etc/nats:ro",
-        "${access:tls}:/tls:ro"
+        "${access:tls}:/tls:ro",
+        "/var/lib/nats-module/snapshot:/opt/mesh:ro",
+        "/var/lib/nats-module/entrypoint:/opt/mesh-entrypoint:ro"
       ],
-      "artifact": "server"
+      "args": [
+        "sh",
+        "/opt/mesh-entrypoint/entrypoint.sh"
+      ],
+      "artifact": "server",
+      "restart-on": [
+        "program-snapshot",
+        "program-entrypoint"
+      ]
     }
   ],
   "accesses": [
@@ -129,21 +153,24 @@
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "NATS_BASE",
-        "image": "nats@sha256:e4bf19f15fd3218814a4e3c9e0064e1334bd8aa20d5984b9f1a0afd084f8cc00"
-      },
-      {
-        "arg": "GO_BASE",
-        "image": "golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c"
-      }
-    ],
     "artifacts": [
       {
         "name": "server",
-        "kind": "image",
-        "from": "Dockerfile"
+        "kind": "upstream",
+        "from": "nats:2.11.17-alpine@sha256:e4bf19f15fd3218814a4e3c9e0064e1334bd8aa20d5984b9f1a0afd084f8cc00"
+      },
+      {
+        "name": "snapshot",
+        "kind": "bundle",
+        "language": "go",
+        "system": "alpine",
+        "from": "cmd/mesh-nats-snapshot",
+        "binary": "mesh-nats-snapshot"
+      },
+      {
+        "name": "entrypoint",
+        "kind": "archive",
+        "from": "program"
       },
       {
         "name": "tools",