CAT-D1, D2, D3b, D4, D6 (wiring): distribution's program, its tools bundle and its manifest

The program serves the store's port 5000 in front of the registry container, now on the node's loopback
(127.0.0.1:5001), listed before the program so the port is free when it starts (E14). The tools bundle serves
each seat's verbs as <seat>.<verb> and registry_incoming, registry_holds, registry_old_name and
registry_direct_writes, on distribution's own account, with the caller the tool runner proved. The manifest
claims container-image-registry and oci-artifact-registry with their verbs, keeps mesh-artifact-store and
provides artifact-store until the old name closes (E15), asks its bus state in requires (incoming, transfers,
holds, windows, findings, events) and declares its health outside the program. The bootstrap's one-off
credential is discarded at the first publish answered.

Not yet: the runtime's object store helper for incoming (mesh-sdk), the windows' driver on delivered and
manifest-reads-changed, the read-side health probe calling versions per seat.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/module.json

@@ -1,6 +1,6 @@
 {
   "module": "distribution",
-  "version": "1",
+  "version": "2",
   "provides": [
     {
       "name": "artifact-store",
@@ -11,17 +11,111 @@
     }
   ],
   "claims": [
+    {
+      "name": "container-image-registry",
+      "scope": "mesh",
+      "serves": [
+        "hold",
+        "mirror",
+        "publish",
+        "publish-part",
+        "release",
+        "remove",
+        "tags",
+        "versions"
+      ]
+    },
+    {
+      "name": "oci-artifact-registry",
+      "scope": "mesh",
+      "serves": [
+        "hold",
+        "publish",
+        "publish-part",
+        "release",
+        "remove",
+        "versions"
+      ]
+    },
     {
       "name": "mesh-artifact-store",
       "scope": "mesh"
     }
   ],
+  "tools": [
+    "registry_direct_writes",
+    "registry_holds",
+    "registry_incoming",
+    "registry_old_name"
+  ],
+  "invokes": [
+    "mesh-delivery-builder.builder_versions",
+    "mesh-delivery-view.node_haves",
+    "seat:node-engine.manifest-reads"
+  ],
+  "consumes": [
+    "mesh-delivery-view.delivered"
+  ],
+  "emits": [
+    "old-name-closed",
+    "direct-writes-closed"
+  ],
+  "config": {
+    "callers": {
+      "type": "string",
+      "trusted": true,
+      "description": "per verb, the modules that may call it (JSON object of verb to modules; operator for the operator's session); empty is design 51's list"
+    }
+  },
+  "requires": [
+    {
+      "name": "incoming",
+      "storage": "object-store",
+      "template": "objects",
+      "options": {
+        "max-mib": 8192
+      }
+    },
+    {
+      "name": "transfers",
+      "storage": "key-value",
+      "template": "state",
+      "options": {
+        "ttl-seconds": 86400
+      }
+    },
+    {
+      "name": "holds",
+      "storage": "key-value",
+      "template": "state"
+    },
+    {
+      "name": "windows",
+      "storage": "key-value",
+      "template": "state"
+    },
+    {
+      "name": "findings",
+      "storage": "key-value",
+      "template": "state"
+    },
+    {
+      "name": "events",
+      "storage": "stream",
+      "template": "events",
+      "options": {
+        "max-age-days": 7,
+        "max-mib": 16
+      }
+    }
+  ],
   "capabilities": [
     "container-runtime"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/registry/broker"
   },
+  "secrets-owner": "distribution",
   "serves": {
     "artifact-store": {
       "port": 5000
@@ -33,7 +127,7 @@
       "port": 5000,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "every machine pulls images and artifacts from here"
+      "why": "every machine pulls images and artifacts from here; distribution's program serves it in front of the store"
     }
   ],
   "data": {
@@ -49,19 +143,28 @@
     ]
   },
   "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "distribution",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh/registry"
+    },
     {
       "id": "state",
       "type": "directory",
       "path": "/var/lib/mesh/registry",
       "mode": "0700",
-      "unknown": "program"
+      "unknown": "program",
+      "owner": "distribution"
     },
     {
       "id": "registry-data",
       "type": "directory",
       "path": "/var/lib/mesh-registry",
       "mode": "0700",
-      "unknown": "program"
+      "unknown": "program",
+      "owner": "distribution"
     },
     {
       "id": "store",
@@ -69,7 +172,7 @@
       "name": "mesh-registry",
       "image": "registry@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373",
       "ports": [
-        "5000:5000"
+        "127.0.0.1:5001:5000"
       ],
       "volumes": [
         "/var/lib/mesh-registry:/var/lib/registry"
@@ -78,6 +181,25 @@
         "REGISTRY_STORAGE_DELETE_ENABLED": "true"
       }
     },
+    {
+      "id": "program",
+      "type": "process",
+      "name": "distribution",
+      "artifact": "program",
+      "run": [
+        "./distribution"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/var/lib/mesh/registry/broker",
+        "MESH_REGISTRY_LOOPBACK": "http://127.0.0.1:5001",
+        "MESH_REGISTRY_LISTEN": ":5000"
+      },
+      "user": "distribution",
+      "health": {
+        "kind": "http",
+        "url": "http://127.0.0.1:5000/v2/"
+      }
+    },
     {
       "id": "collect",
       "type": "container",
@@ -95,5 +217,28 @@
         "store"
       ]
     }
-  ]
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "program",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/distribution",
+        "binary": "distribution"
+      },
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/distribution-tools",
+        "binary": "distribution-tools",
+        "loads": [
+          "distribution-tools"
+        ]
+      }
+    ]
+  }
 }