A module may mirror an image it did not write

A module usually runs software somebody else built: a database module
ships configuration and a provisioner and does not build a database. It
could name the upstream reference directly, and then every machine needs
a route to a public registry and the reference is a tag somebody else can
move — which is what pinning exists to prevent.

So an artifact may be `upstream`: pulled by the reference the module
names, pushed into the mesh's own registry, and pinned by the digest that
registry assigns. This is what the bootstrap already does by hand; it is
now something a module can say.

Refused: an upstream reference with no tag or digest, because what gets
mirrored would be whatever `latest` means today and a module pinned to
that is not pinned. And the rule that a build reads only its own
repository does not apply to it — applying it anyway refused every
reference with a registry host in it, which the test caught.

Written by trying to write a real postgres module and finding it could
not be said. It can now: two directories, two containers pinned by
digest, a superuser password sealed to the machine, and the grants
manifest — six resources from one assignment, all accepted by the host's
own parser.

That exercise also found my manifest wrong rather than the host: a
container declared `restart-on`, which is a service field, and the host
refused it by name. It is right to. A container whose own definition
changes is recreated, and a file it mounts is read by the process inside,
which is that image's business.

internal/builder/builder.go

@@ -128,6 +128,19 @@ func one(ctx context.Context, run Runner, publish Publisher,
 	module, tree, commit string, a catalogue.Artifact) (catalogue.Built, error) {
 
 	switch a.Kind {
+	case catalogue.ArtifactUpstream:
+		// Mirrored, not built. Pulled by the reference the module names and pushed under a name
+		// of the mesh's own, so what a machine fetches is pinned by a digest this registry
+		// assigned rather than by a tag somebody else can move.
+		if _, err := run(ctx, tree, "docker", "pull", a.From); err != nil {
+			return catalogue.Built{}, fmt.Errorf("%s: cannot fetch %s: %w", module, a.From, err)
+		}
+		reference, err := publish.PublishImage(ctx, a.From, module+"/"+a.Name)
+		if err != nil {
+			return catalogue.Built{}, err
+		}
+		return catalogue.Built{Name: a.Name, Kind: a.Kind, Reference: reference}, nil
+
 	case catalogue.ArtifactImage:
 		// Tagged by commit rather than by version, because a version is what a person calls a
 		// release and a commit is what was actually built. The mesh pins the digest anyway; this