Capture mesh-catalog at feat/r4g (2246ccc4) with the templates its manifests name and its predefined.json, and lay the copy out as a repository's root

The catalogue's manifests moved their content into template files and fall back to predefined keys, so a copy of
module.json alone no longer passes the catalogue's own check; the bus's Dockerfile is gone from the catalogue.

testdata/beside/mesh-catalog/modules/mesh-vault/module.json.captured

@@ -1,6 +1,7 @@
 {
   "module": "mesh-vault",
   "version": "1",
+  "runs-as": "mesh-vault",
   "provides": [
     {
       "name": "secret",
@@ -10,18 +11,13 @@
       }
     }
   ],
-  "capabilities": [
-    "container-runtime"
-  ],
   "emits": [
     "provisioned",
     "rotated",
-    "deprovisioned"
+    "secret-changed"
   ],
-  "consumes": [
-    "mesh-vault.provisioned",
-    "mesh-vault.rotated",
-    "mesh-vault.deprovisioned"
+  "reads": [
+    "mesh-controller.assignments"
   ],
   "receives": {
     "secret": "${dir:grants}/mesh.json"
@@ -49,6 +45,12 @@
         "path": "${dir:root}",
         "class": "valuable",
         "why": "the vault's root material"
+      },
+      {
+        "id": "store",
+        "path": "${dir:store}",
+        "class": "valuable",
+        "why": "every secret the vault holds, sealed to its own key and to the operator key"
       }
     ],
     "consumers": {
@@ -59,27 +61,61 @@
       }
     }
   },
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-vault",
+  "runtime-health": {
+    "kind": "tool",
+    "tool": "vault_health",
+    "interval": "60s",
+    "timeout": "10s",
+    "looks": 2,
+    "grace": "60s"
+  },
   "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-vault",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-vault"
+    },
     {
       "id": "state",
       "type": "directory",
       "mode": "0700",
-      "place": "."
+      "owner": "mesh-vault",
+      "place": ".",
+      "unknown": "program"
     },
     {
       "id": "grants",
       "type": "directory",
-      "mode": "0700"
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
     },
     {
       "id": "ledger",
       "type": "directory",
-      "mode": "0700"
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
     },
     {
       "id": "root",
       "type": "directory",
-      "mode": "0700"
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
+    },
+    {
+      "id": "store",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
     }
   ],
   "build": {
@@ -87,29 +123,51 @@
       {
         "name": "code",
         "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "index.js",
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-vault",
+        "binary": "mesh-vault",
         "loads": [
-          "index.js",
-          "tools/index.js",
-          "provisioner/index.js"
+          "mesh-vault"
         ],
         "env": {
           "MESH_RECEIVES": "${dir:grants}/mesh.json",
           "MESH_VAULT_LEDGER": "${dir:ledger}",
-          "MESH_VAULT_ROOT": "${dir:root}"
+          "MESH_VAULT_ROOT": "${dir:root}",
+          "MESH_VAULT_STORE": "${dir:store}",
+          "MESH_VAULT_STATE": "${dir:state}"
         }
       }
     ]
   },
+  "tools": [
+    "secret_export",
+    "secret_holders",
+    "secret_verify",
+    "secret_handed",
+    "secret_asks",
+    "secret_vault_export",
+    "provisioner_retirement",
+    "provisioner_retire_approve",
+    "provisioner_retire_reject",
+    "provisioner_delete",
+    "vault_status",
+    "vault_health"
+  ],
   "claims": [
     {
       "name": "mesh-vault",
-      "scope": "mesh"
+      "scope": "mesh",
+      "serves": [
+        "get",
+        "accept",
+        "secret-ask",
+        "issued",
+        "rotate",
+        "move-in",
+        "node-key",
+        "move-asks"
+      ]
     }
   ]
 }