Let the build agent run on the genesis document until its registry binds (hq issue 121, ADR 0336)

With npm-package-registry optional, the binding file the agent's environment
names may be absent, and mesh-builder failed every build on reading it. It now
reads the genesis document the installer seals at genesis's packages step when
no binding is present, prefers the binding when both are, and each build's log
says which it resolved from (§4). A build that needs the registry - a package,
an image naming .npmrc, TypeScript with an @novox/ dependency - on an agent with
neither is refused before anything is built or published, naming the machine,
the unbound requirement and gitea (§6); it never falls back to the public
registry. The captured catalogue moves to the mesh-catalog change it is judged
with.

testdata/beside/mesh-catalog/modules/docker/module.json.captured

@@ -44,6 +44,18 @@
       "docker exec cat /etc/resolv.conf"
     ]
   },
+  "settings": {
+    "log-max-size": {
+      "kind": "preference",
+      "default": "100m",
+      "why": "each container's log is cut at this size and the runtime keeps log-max-file of them, so 100m and 10 hold about 1 GB per container: what the one machine with rotation set by hand has (novox/hq issue 452). A whole number from 1 with k, m or g after it, refused before daemon.json is written. The runtime reads it only at its next start, which the mesh never forces, and a container created before that keeps the options it was created with until it is created again"
+    },
+    "log-max-file": {
+      "kind": "preference",
+      "default": 10,
+      "why": "how many of a container's log files of log-max-size the runtime keeps, the oldest dropped first; a count from 1 to 99, refused before daemon.json is written, taken at the runtime's next start and by containers created after it, like log-max-size (novox/hq issue 452)"
+    }
+  },
   "resources": [
     {
       "id": "package",
@@ -62,13 +74,45 @@
       "state": "running",
       "boot": "enabled"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
+    {
+      "id": "log-rotation",
+      "type": "file",
+      "path": "${dir:state}/log-rotation.conf",
+      "mode": "0600",
+      "trusted": true,
+      "content": "# The log rotation daemon.json takes, written by the mesh from this machine's settings log-max-size and\n# log-max-file, and judged by the step log-rotation-check before daemon.json is written (novox/hq issue 452).\n# Replaced on every push; change the settings, never this file.\nsize=${setting:log-max-size}\nfiles=${setting:log-max-file}\n"
+    },
+    {
+      "id": "log-rotation-check",
+      "type": "process",
+      "name": "docker-log-rotation-check",
+      "artifact": "tools",
+      "run": [
+        "./docker-tools",
+        "check-log-rotation"
+      ],
+      "run-once": true,
+      "env": {
+        "DOCKER_LOG_ROTATION": "${dir:state}/log-rotation.conf"
+      },
+      "restart-on": [
+        "log-rotation"
+      ]
+    },
     {
       "id": "daemon",
       "type": "file",
       "path": "/etc/docker/daemon.json",
       "mode": "0644",
       "into": "json",
-      "content": "{\"live-restore\": true, \"insecure-registries\": [\"${seat:mesh-artifact-store:reach}\"]}\n"
+      "trusted": true,
+      "content": "{\"live-restore\": true, \"insecure-registries\": [\"${seat:mesh-artifact-store:reach}\"], \"log-driver\": \"json-file\", \"log-opts\": {\"max-size\": \"${setting:log-max-size}\", \"max-file\": \"${setting:log-max-file}\"}}\n"
     },
     {
       "id": "runtime",