The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

The 21 media/home modules, the SaaS tool modules (cloudflare-dns,
confluence, gitlab, jira), model-usage, and the model-access trio get
the same Dockerfile + build section as batch 1. Scheduled-only modules
(anthropic-consumer, anthropic-manager, openai-consumer) deliberately
declare no MESH_TOOL_MODULES — every container of theirs names its
command. mosquitto's run-once bootstrap container builds from the same
artifact. Modules with third-party deps (model-usage: pg;
anthropic-manager: tweetnacl) install them beside their compiled code.

Also fixes cloudflare-dns's package.json, unparseable since its
description lost a closing quote.

Deliberately still without build sections: builder and mesh-controller
(the foundation builds them by its own path), distribution (provides
the artifact store — building it through itself is refused by design),
route-proxy (cross-repo build context, deferred), and the
upstream-image-only modules, which have no code to build.

modules/mosquitto/Dockerfile

@@ -0,0 +1,28 @@
+# mosquitto's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/mosquitto
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+# mosquitto's client and bootstrap drive `mosquitto_ctrl`; the apt package carries it with its
+# shared libraries — the musl binary from the eclipse image would not load on this glibc base.
+RUN apt-get update && apt-get install -y --no-install-recommends mosquitto \
+ && rm -rf /var/lib/apt/lists/*
+COPY --from=build /app/modules/mosquitto/dist /app/modules/mosquitto/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/mosquitto/dist/index.js,/app/modules/mosquitto/dist/tools/index.js,/app/modules/mosquitto/dist/provisioner/index.js

modules/mosquitto/module.json

@@ -89,7 +89,6 @@
       "id": "bootstrap",
       "type": "container",
       "name": "mosquitto-bootstrap",
-      "image": "mesh-runtime-mosquitto@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "run-once": true,
       "volumes": [
         "/services/mosquitto/data:/mosquitto/data",
@@ -104,7 +103,8 @@
       "args": [
         "run",
         "/app/modules/mosquitto/dist/bootstrap/index.js"
-      ]
+      ],
+      "artifact": "runtime"
     },
     {
       "id": "server",
@@ -125,7 +125,6 @@
       "id": "runtime",
       "type": "container",
       "name": "mesh-mosquitto",
-      "image": "mesh-runtime-mosquitto@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "mosquitto",
       "volumes": [
         "/var/lib/mesh/mosquitto/broker:/run/secrets/broker:ro",
@@ -138,7 +137,29 @@
         "MESH_PROVISION_MQTT": "mosquitto:1883",
         "MESH_PROVISION_ADMIN_USER": "mesh-admin",
         "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin"
-      }
+      },
+      "artifact": "runtime"
     }
-  ]
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
 }