The builder builds one module and stops, with no broker and no registry

This is how a mesh is raised: the installer carries this program and runs it
once, before anything exists, to produce the control plane from the same
repository and path every later rebuild will use. What raises the mesh is then
the same thing that maintains it, rather than a second mechanism exercised once
per new mesh — which is how often enough to rot.

With nowhere to publish, an image stays in the machine's own runtime and is
named by the digest of its own configuration: the same identity the installer
has always used for the image it carried.

cmd/mesh-builder/main.go

@@ -56,6 +56,14 @@ is dialled except the broker.
   MESH_REGISTRY      host:port to publish artifacts to, when the mesh has not said
   MESH_BINDING       a file the mesh wrote saying where the artifact store is
   MESH_WORKSPACE     where to clone and build (default: a temporary directory)
+
+It also builds one module and stops, which is how a mesh is raised — before there is a
+broker to take work from or a registry to publish into:
+
+  mesh-builder build <repository> [--path P] [--ref COMMIT] [--registry HOST:PORT]
+
+Without --registry the artifacts stay in this machine's container runtime, named by the
+digest of their own configuration. The result is printed as JSON.
 `
 
 func run() error {
@@ -64,6 +72,8 @@ func run() error {
 		case "version":
 			fmt.Println(version)
 			return nil
+		case "build":
+			return buildOnce(context.Background(), os.Args[2:])
 		default:
 			fmt.Print(usage)
 			return nil