Capture mesh-catalog at feat/r4g (2246ccc4) with the templates its manifests name and its predefined.json, and lay the copy out as a repository's root

The catalogue's manifests moved their content into template files and fall back to predefined keys, so a copy of
module.json alone no longer passes the catalogue's own check; the bus's Dockerfile is gone from the catalogue.

testdata/beside/mesh-catalog/modules/grafana/module.json.captured

@@ -29,24 +29,41 @@
       }
     ]
   },
+  "config": {
+    "user": {
+      "type": "string",
+      "description": "The Grafana account the module's tools sign in as with the vault's password; the file's default is admin.",
+      "trusted": true,
+      "default": "admin"
+    },
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Grafana at, as a URL; unset, the code falls back to its environment, else this machine's Grafana on its port.",
+      "trusted": true,
+      "default": ""
+    }
+  },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
       "mode": "0700",
-      "place": "mesh"
+      "place": "mesh",
+      "unknown": "program"
     },
     {
       "id": "state",
       "type": "directory",
       "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
     },
     {
       "id": "data",
       "type": "directory",
       "mode": "0700",
-      "owner": "472:472"
+      "owner": "472:472",
+      "unknown": "program"
     },
     {
       "id": "admin-secret",
@@ -54,7 +71,7 @@
       "path": "${dir:state}/admin.secret",
       "mode": "0400",
       "owner": "472:472",
-      "content": "${secret:admin}"
+      "template": "files/admin.secret"
     },
     {
       "id": "oidc-secret",
@@ -62,28 +79,30 @@
       "path": "${dir:state}/oidc-client.secret",
       "mode": "0400",
       "owner": "472:472",
-      "content": "${secret:oidc-client}"
+      "template": "files/oidc-client.secret"
     },
     {
       "id": "oidc-env",
       "type": "file",
       "path": "${dir:state}/oidc.env",
       "mode": "0644",
-      "content": "GF_SERVER_ROOT_URL=https://${bound:route:name}\nGF_AUTH_GENERIC_OAUTH_ENABLED=true\nGF_AUTH_GENERIC_OAUTH_NAME=Keycloak\nGF_AUTH_GENERIC_OAUTH_CLIENT_ID=${bound:oidc-client:as}\nGF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE=/run/secrets/oidc-client\nGF_AUTH_GENERIC_OAUTH_SCOPES=openid email profile roles\nGF_AUTH_GENERIC_OAUTH_AUTH_URL=${bound:oidc-client:issuer}${bound:oidc-client:authorization-path}\nGF_AUTH_GENERIC_OAUTH_TOKEN_URL=${bound:oidc-client:issuer}${bound:oidc-client:token-path}\nGF_AUTH_GENERIC_OAUTH_API_URL=${bound:oidc-client:issuer}${bound:oidc-client:userinfo-path}\nGF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || contains(realm_access.roles[*], 'admin') && 'Admin' || 'Viewer'\nGF_AUTH_GENERIC_OAUTH_USE_PKCE=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN=true\n"
+      "template": "files/oidc.env"
     },
     {
       "id": "influxdb-datasources",
       "type": "directory",
       "path": "${dir:state}/datasources",
       "mode": "0755",
-      "owner": "472:472"
+      "owner": "472:472",
+      "unknown": "program"
     },
     {
       "id": "influxdb-credential",
       "type": "directory",
       "path": "${dir:state}/influxdb",
       "mode": "0700",
-      "owner": "472:472"
+      "owner": "472:472",
+      "unknown": "program"
     },
     {
       "id": "influxdb-secret",
@@ -91,7 +110,7 @@
       "path": "${dir:influxdb-credential}/influxdb-api",
       "mode": "0400",
       "owner": "472:472",
-      "content": "${secret:influxdb-api}",
+      "template": "files/influxdb-api",
       "only-when-bound": "influxdb-api"
     },
     {
@@ -99,7 +118,7 @@
       "type": "file",
       "path": "${dir:influxdb-datasources}/mesh-influxdb.yaml",
       "mode": "0644",
-      "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}\n    user: ${bound:influxdb-api:as}\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: ${bound:influxdb-api:bucket}\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
+      "template": "files/mesh-influxdb.yaml",
       "only-when-bound": "influxdb-api"
     },
     {
@@ -140,8 +159,10 @@
       "type": "file",
       "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
-      "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
-      "merge": "json"
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": ["user", "url"],
+      "protected": ["password", "token"]
     }
   ],
   "requires": [
@@ -193,6 +214,11 @@
           "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
           "MESH_GRAFANA_CONFIG_FILE": "${dir:mesh-state}/config.json"
         }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   }