mesh-build-node: narrow the fetch to the named paths, build members against the SDK their lock names, and build, pack and publish a package (issues 1758, 1587 S15-S19; ADR 0499 §4, ADR 0498 §5, ADR 0500 §4-§6; lead decision L10)

build_node_fetch takes buildstep.FetchRequest (dir and paths narrow the workspace) and an
optional package {repository, commit, ref}: the group's package member, built and packed
shut off and published nowhere. Each member's lock decides its SDK: the group's packed
file when the version and integrity are the lock's, else the registry's (integrity
checked); a version the registry lacks fails waits for: @novox/mesh-sdk@<version>. A
package artifact is built by its own script and packed with npm pack, shut off; only a
trunk build publishes it, from this process with the write credential (never in a
workspace): absent is published, the same file is done, another is version taken:. The
registry configuration file now lies outside every workspace.

modules/mesh-build-node/README.md

@@ -58,6 +58,15 @@ toolchain install: a long step answers at once with its id and ends on `<node>.<
   other `@novox/` packages install. A module with packages and no lock does not fail the fetch: its result lists it
   under `refused` with the reason, and a build of that bundle fails naming it (issue 1459). Every command runs through `forgekey.ExecRunnerClean(0)` with PATH, HOME, the locale and its own
   words, nothing of this process's environment. Workspaces older than a day are removed at each fetch.
+  The arguments are mesh-sdk's `buildstep.FetchRequest` (ADR 0499 §4): with `dir` and `paths` (from the builder, never
+  from a manifest) the workspace is narrowed to those paths, the manifest and the lock files before anything else. A
+  member is built against the SDK version its own lock names (the lead's decision L10 of R4e, ADR 0500 §5-§6): the
+  fetch places that version in the module's `node_modules/@novox/mesh-sdk`, from the group's package when the call
+  names one (`package: {repository, commit, ref}`: fetched, its dependencies installed from its own lock, built and
+  packed shut off, published nowhere) and its version and integrity are the lock's, else from the registry (integrity
+  checked); a version the registry lacks fails `waits for: @novox/mesh-sdk@<version>` (the builder queues the key), or,
+  with a group package of another version, fails naming both. A module whose lock names no SDK keeps the toolchain's.
+  A module whose artifact is a `package` gets its dependencies, devDependencies included, from its own lock instead.
 - `build_node_test` {workspace, module, level} (issue 1491): the unit level is the type-check (the toolchain's tsc, the
   package's `tsconfig.json` or the build agent's flags over its .ts files) and the `test` script; the integration level
   is the `test:integration` script, the type-check being its setup. Bounds (the Go module's; ADR 0445 names none for
@@ -76,3 +85,8 @@ toolchain install: a long step answers at once with its id and ends on `<node>.<
   step `not stored: <artifact>: <the store's words>`. The packed bytes never stay on the node. tsc and esbuild, like the
   type-check and the test script, run shut off in bubblewrap (ADR 0448): no network, none of the account, the toolchain
   read-only, the npm cache beneath a throwaway layer unless the step is told `publish` (a trunk build).
+  A `package` artifact (ADR 0498 §5) is built by its own `build` script and packed with `npm pack --ignore-scripts`, both
+  shut off; its digest is the packed file's. Only with `publish` is it published, by this process with the registry's
+  write credential (never in a workspace or a step's mounts): a version the registry lacks is published, the same
+  packed file already there is done without a publish, another file under that version fails `version taken:
+  <name>@<version>`; the reference `<name>@<version>` is answered only then. A candidate answers its digest alone.