docker: trust the store at the image seat's reach (ADR 0632 §1; issue 1966)

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/docker/cmd/docker-tools/logrotation_test.go

@@ -68,7 +68,12 @@ func filled(t *testing.T, m manifestForLogs, content string) string {
 	if len(missing) > 0 {
 		t.Fatalf("the content asks for %v, which the manifest gives no preference default", missing)
 	}
-	return strings.ReplaceAll(out, "${seat:mesh-artifact-store:reach}", "registry.example:5100")
+	// The store's address is the image seat holder's listen (novox/hq ADR 0632 §1), never the retired provision's.
+	const reach = "${seat:container-image-registry:reach}"
+	if strings.Contains(content, "insecure-registries") && !strings.Contains(content, reach) {
+		t.Fatalf("the runtime trusts no %s: %s", reach, content)
+	}
+	return strings.ReplaceAll(out, reach, "registry.example:5100")
 }
 
 func TestTheDefaultLogRotationIsTheOneTheHandSetMachineHas(t *testing.T) {