The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

The 21 media/home modules, the SaaS tool modules (cloudflare-dns,
confluence, gitlab, jira), model-usage, and the model-access trio get
the same Dockerfile + build section as batch 1. Scheduled-only modules
(anthropic-consumer, anthropic-manager, openai-consumer) deliberately
declare no MESH_TOOL_MODULES — every container of theirs names its
command. mosquitto's run-once bootstrap container builds from the same
artifact. Modules with third-party deps (model-usage: pg;
anthropic-manager: tweetnacl) install them beside their compiled code.

Also fixes cloudflare-dns's package.json, unparseable since its
description lost a closing quote.

Deliberately still without build sections: builder and mesh-controller
(the foundation builds them by its own path), distribution (provides
the artifact store — building it through itself is refused by design),
route-proxy (cross-repo build context, deferred), and the
upstream-image-only modules, which have no code to build.

modules/openai-consumer/Dockerfile

@@ -0,0 +1,22 @@
+# openai-consumer's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/openai-consumer
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc apply/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/openai-consumer/dist /app/modules/openai-consumer/dist
+# No serve-time entrypoints: every container of this module names its command (`run` on a
+# schedule), so nothing here serves — deliberately no MESH_TOOL_MODULES.

modules/openai-consumer/module.json

@@ -31,7 +31,6 @@
       "id": "apply",
       "type": "container",
       "name": "mesh-openai-consumer-apply",
-      "image": "mesh-runtime-openai-consumer@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "host",
       "schedule": "*/5 * * * *",
       "args": [
@@ -46,7 +45,29 @@
         "MESH_MODEL_ACCESS_BIND_FILE": "/run/state/model.json",
         "MESH_OPENAI_ENV_FILE": "/run/state/config/openai.env",
         "MESH_OPENAI_CREDENTIALS_FILE": "/run/state/config/auth.json"
-      }
+      },
+      "artifact": "runtime"
     }
-  ]
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
 }