docker: trust the store at the image seat's reach (ADR 0632 §1; issue 1966)

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/docker/README.md

@@ -36,10 +36,10 @@ either. Under ADR 0196 a container copies its machine's resolvers, so no module
 controller's private network wrote `insecure-registries`; under ADR 0222 the controller writes
 nothing into this file, and this module states the registry itself (the order below).
 
-- `daemon`: `{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"]}`,
+- `daemon`: `{"live-restore": true, "insecure-registries": ["${seat:container-image-registry:reach}"]}`,
   merged into the file beside the keys others write.
-- `${seat:mesh-artifact-store:reach}` is where this machine reaches the mesh's artifact store
-  (host:port), filled in by the controller: no binding, no credential, the same address the mesh
+- `${seat:container-image-registry:reach}` is where this machine reaches the mesh's artifact store
+  (host:port), the image seat holder's listen open to the mesh (ADR 0632 §1), filled in by the node-engine: no binding, no credential, the same address the mesh
   composes into every image it built. Trusting it in the clear is ADR 0082's decision: every path to
   it is inside the private network's encryption. While no machine on the network holds the store the
   answer is empty, and the controller drops the empty member, so the list gets nothing.