Capture mesh-catalog at feat/r4g (2246ccc4) with the templates its manifests name and its predefined.json, and lay the copy out as a repository's root

The catalogue's manifests moved their content into template files and fall back to predefined keys, so a copy of
module.json alone no longer passes the catalogue's own check; the bus's Dockerfile is gone from the catalogue.

testdata/beside/mesh-catalog/modules/pacman/module.json.captured

@@ -11,14 +11,73 @@
       "scope": "node"
     }
   ],
+  "reads": [
+    "mesh-controller.declared-packages"
+  ],
+  "uses": [
+    "operator-channel"
+  ],
+  "config": {
+    "upgrade-order": {
+      "type": "list",
+      "description": "The nodes in the order they upgrade, each by its name: the first opens each week's round on Saturday at 04:00 local time, and each node upgrades after the one before it passed its after-upgrade check (novox/hq ADR 0508 §5). Empty: no round starts, and every node's health says why. Falls back to the mesh-level key of the same name.",
+      "trusted": true,
+      "predefined": "upgrade-order",
+      "default": []
+    },
+    "record-days": {
+      "type": "number",
+      "description": "How many days a package record taken before an upgrade is kept on the bus before it is deleted (novox/hq ADR 0508 §2); a rollback can return only to a record still kept.",
+      "minimum": 1,
+      "trusted": false,
+      "default": 180
+    },
+    "round-start-minutes": {
+      "type": "number",
+      "description": "How many minutes a node whose turn in the round came may take to start its upgrade before the round is said to stand still, in that node's and the waiting nodes' health (novox/hq ADR 0508 §6).",
+      "minimum": 1,
+      "trusted": false,
+      "default": 120
+    }
+  },
+  "own-secrets": {
+    "broker-keeper": {
+      "path": "${dir:state}/broker-keeper.secret",
+      "owner": "pacman-keeper"
+    }
+  },
+  "state": [
+    "installed",
+    "updates",
+    "runs",
+    "records",
+    "rounds",
+    "asks"
+  ],
+  "emits": [
+    "package.changed",
+    "upgrade.recorded",
+    "upgrade.kernel-held",
+    "upgrade.started",
+    "upgrade.finished",
+    "upgrade.failed",
+    "upgrade.checked",
+    "rollback.started",
+    "rollback.finished"
+  ],
   "tools": [
     "pacman_search",
     "pacman_info",
     "pacman_installed",
+    "pacman_packages",
     "pacman_owns",
     "pacman_files",
     "pacman_updates",
     "pacman_upgrade",
+    "pacman_upgrade_health",
+    "pacman_upgrades",
+    "pacman_rollback",
+    "pacman_round",
     "pacman_orphans",
     "pacman_remove_orphans",
     "pacman_cache",
@@ -39,7 +98,7 @@
       "type": "file",
       "path": "/etc/pacman.conf",
       "mode": "0644",
-      "content": "# The mesh's (module pacman, novox/hq to-be 42): the package manager's configuration. Written\n# whole at every push: an edit here is overwritten, and the file a machine had before is kept once by\n# the host. Owned whole because [options] cannot take a block by appending: anything added at the end\n# of the file lands in the last repository's section.\n#\n# The repositories are the union of what the machines had enabled when the module was written\n# (core, extra, multilib). The options are the distribution's defaults with four more: colour on a\n# terminal, parallel downloads, package lists in columns, and downloads run as the unprivileged\n# alpm user, which pacman 7 creates.\n\n[options]\nHoldPkg     = pacman glibc\nArchitecture = auto\nCheckSpace\nColor\nVerbosePkgLists\nParallelDownloads = 5\nDownloadUser = alpm\nSigLevel    = Required DatabaseOptional\nLocalFileSigLevel = Optional\n\n[core]\nInclude = /etc/pacman.d/mirrorlist\n\n[extra]\nInclude = /etc/pacman.d/mirrorlist\n\n[multilib]\nInclude = /etc/pacman.d/mirrorlist\n"
+      "template": "files/pacman.conf"
     },
     {
       "id": "contrib",
@@ -56,21 +115,120 @@
       "type": "file",
       "path": "/etc/xdg/reflector/reflector.conf",
       "mode": "0644",
-      "content": "# The mesh's (module pacman, novox/hq to-be 42): how reflector refreshes the mirror list, weekly,\n# through reflector.timer. Written whole at every push. Before the module, every machine's list was\n# generated once and never again.\n--save /etc/pacman.d/mirrorlist\n--protocol https\n--country Belgium,Netherlands,Luxembourg,Germany,France\n--latest 20\n--sort rate\n"
+      "template": "files/reflector.conf"
     },
     {
       "id": "mirror-refresh",
       "type": "service",
       "unit": "reflector.timer",
       "state": "running",
-      "boot": "enabled"
+      "boot": "enabled",
+      "health": {
+        "kind": "unit"
+      }
     },
     {
       "id": "cache-cleaning",
       "type": "service",
       "unit": "paccache.timer",
       "state": "running",
-      "boot": "enabled"
+      "boot": "enabled",
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "keeper-account",
+      "type": "user",
+      "name": "pacman-keeper",
+      "shell": "/usr/bin/nologin"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0711",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "keeper-config",
+      "type": "file",
+      "path": "${dir:state}/keeper.json",
+      "mode": "0644",
+      "takes-config": [
+        "upgrade-order",
+        "record-days",
+        "round-start-minutes"
+      ],
+      "merge": "json",
+      "template": "files/keeper.json",
+      "trusted": true
+    },
+    {
+      "id": "root-helper",
+      "type": "process",
+      "name": "pacman-root",
+      "artifact": "tools",
+      "run": [
+        "./pacman-tools",
+        "root"
+      ],
+      "env": {
+        "PACMAN_ROOT_SOCKET": "${dir:state}/root/helper.sock",
+        "PACMAN_ROOT_PEER": "pacman-keeper"
+      },
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "keeper",
+      "type": "process",
+      "name": "pacman-keeper",
+      "artifact": "tools",
+      "run": [
+        "./pacman-tools",
+        "keeper"
+      ],
+      "user": "pacman-keeper",
+      "env": {
+        "PACMAN_KEEPER_BROKER": "${dir:state}/broker-keeper.secret",
+        "PACMAN_KEEPER_CONFIG": "${dir:state}/keeper.json",
+        "PACMAN_ROOT_SOCKET": "${dir:state}/root/helper.sock"
+      },
+      "restart-on": [
+        "keeper-config"
+      ],
+      "bus": {
+        "state": [
+          "installed",
+          "updates",
+          "runs",
+          "records",
+          "rounds",
+          "asks"
+        ],
+        "emits": [
+          "package.changed",
+          "upgrade.recorded",
+          "upgrade.kernel-held",
+          "upgrade.started",
+          "upgrade.finished",
+          "upgrade.failed",
+          "upgrade.checked",
+          "rollback.started",
+          "rollback.finished"
+        ],
+        "asks": true
+      },
+      "health": {
+        "kind": "tool",
+        "tool": "pacman_upgrade_health",
+        "interval": "60s",
+        "timeout": "20s",
+        "looks": 2,
+        "grace": "60s"
+      }
     }
   ],
   "build": {
@@ -84,7 +242,15 @@
         "binary": "pacman-tools",
         "loads": [
           "pacman-tools"
-        ]
+        ],
+        "env": {
+          "PACMAN_KEEPER_CONFIG": "${dir:state}/keeper.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   }