The builder resolves the SDK from the mesh registry, and can publish packages

A new 'package' artifact kind builds a module's own code on a public base image
and publishes it to the mesh's package registry by version (hq ADR 0076) — the
SDK above all, which the toolchain is built from and so cannot be built in the
toolchain. The credential a build needs to resolve or publish packages is
rendered as an .npmrc (basic auth, hq ADR 0048) and given to an image build as a
buildkit secret, never a layer, so a token is not baked into the toolchain image.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/catalogue/build.go

@@ -86,6 +86,12 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 		}
 		delete(filled, "artifact")
 		switch artifact.Kind {
+		case ArtifactPackage:
+			// A package is not a resource on any machine; it is consumed by other builds. A
+			// resource that names one is a manifest error, named here rather than shipped.
+			return Manifest{}, fmt.Errorf(
+				"%s: %v uses %q, which is a package — a build input, not a resource a machine runs",
+				m.Module, r["id"], named)
 		case ArtifactImage, ArtifactUpstream:
 			filled["image"] = artifact.Reference
 		case ArtifactArchive, ArtifactBundle:
@@ -123,19 +129,19 @@ func (b *Build) problems(module string) []string {
 		}
 		seen[a.Name] = true
 		switch a.Kind {
-		case ArtifactImage, ArtifactArchive, ArtifactUpstream, ArtifactBundle:
+		case ArtifactImage, ArtifactArchive, ArtifactUpstream, ArtifactBundle, ArtifactPackage:
 		default:
 			problems = append(problems, fmt.Sprintf(
 				"%s: %q is a %q, and an artifact is %q, %q, %q or %q",
 				module, a.Name, a.Kind, ArtifactImage, ArtifactArchive, ArtifactUpstream,
-				ArtifactBundle))
+				ArtifactBundle+", "+ArtifactPackage))
 		}
 		// **A bundle is built from the module itself, so it says a language instead.** Everything
 		// else names what it is built from: a Dockerfile, a directory, somebody else's reference.
 		// A bundle's source is the module's own directory by definition, and what it needs to say
 		// is which compiler — because the mesh chooses that, and cannot choose for a module that
 		// has not said.
-		if a.Kind == ArtifactBundle {
+		if a.Kind == ArtifactBundle || a.Kind == ArtifactPackage {
 			if a.From != "" {
 				problems = append(problems, fmt.Sprintf(
 					"%s: %q is a bundle and names what it is built from (%q). A bundle is built "+