Hold the trust-before-push order by a test, and refuse early what would stop it (issue 92)

The fix is an order, and nothing failed if the trust call moved after the
push or went: steps 7 and 8 are now one function a test drives against a
runtime that refuses an untrusted push. Preflight now refuses, before
anything is raised, a runtime file that is no JSON object, a docker.service
that is not loaded and active, and a dockerd started with
--insecure-registry, which would refuse the reload. The comment names the
order the docker module's takeover rests on.

internal/bootstrap/bootstrap.go

@@ -36,6 +36,7 @@ import (
 	"time"
 
 	"github.com/novox/mesh-host/internal/firewall"
+	"github.com/novox/mesh-host/internal/system"
 	"github.com/novox/mesh-host/internal/tunnel"
 )
 
@@ -658,33 +659,10 @@ func Run(ctx context.Context, o Options, d Deps, say func(string)) (Result, erro
 		return result, failed(StepOperator, err)
 	}
 
-	// ---- 7. registry ----------------------------------------------------------------------
-	say("registry — somewhere for this mesh to keep its own images")
-	// Trusted by the runtime before anything is pushed to it, by every name the mesh will use for
-	// it here: the module that writes this trust is applied long after the push (novox/hq issue 92).
-	trusted, err := TrustTheRegistry(ctx, o, sys, d.Run, say)
-	result.RegistryTrusted = trusted
+	// ---- 7. registry, 8. publish -----------------------------------------------------------
+	published, err := RegistryAndPublish(ctx, o, d, sys, temporary, controlPlaneImage, &result, say)
 	if err != nil {
-		return result, failed(StepRegistry, err)
-	}
-	registry, err := InstallRegistry(ctx, o, d, temporary, say)
-	result.Registry, result.RegistryRunning = registry.Address, registry.Container
-	result.RegistryKnown, result.RegistryReplied = registry.Known, registry.Answered
-	if err != nil {
-		return result, failed(StepRegistry, err)
-	}
-
-	// ---- 8. publish -----------------------------------------------------------------------
-	say("publish — the control plane's image gets its first manifest digest")
-	// **The image this mesh built, not the one the installer carried.** The carried one is the
-	// builder; publishing it here would put a builder in the registry under the control plane's
-	// name and install it as the control plane — which is exactly what happened the first time
-	// this ran, and presented as a control plane that started, printed a builder's usage, and
-	// exited cleanly over and over.
-	published, err := PublishControlPlane(ctx, o, d, controlPlaneImage, say)
-	result.PublishedAs, result.PublishedAlready = published.Reference, published.Already
-	if err != nil {
-		return result, failed(StepPublish, err)
+		return result, err
 	}
 
 	// ---- 9. control plane -----------------------------------------------------------------
@@ -814,3 +792,44 @@ func Run(ctx context.Context, o Options, d Deps, say func(string)) (Result, erro
 
 	return result, nil
 }
+
+// RegistryAndPublish is steps 7 and 8: the runtime trusts the mesh's registry, the registry is
+// installed and answers, and the control plane's image is pushed into it.
+//
+// **One function so the order is held by a test** (novox/hq issue 92). The runtime refuses plain
+// HTTP to a registry it has not been told to trust, and the module that tells it is applied long
+// after the push — so the trust is written and confirmed here, before anything is tagged or pushed.
+// A refusal names the step it happened in.
+func RegistryAndPublish(ctx context.Context, o Options, d Deps, sys system.System, temporary controlPlane,
+	controlPlaneImage string, result *Result, say func(string)) (Published, error) {
+
+	// ---- 7. registry ----------------------------------------------------------------------
+	say("registry — somewhere for this mesh to keep its own images")
+	// Trusted by the runtime before anything is pushed to it, by every name the mesh will use for
+	// it here: the module that writes this trust is applied long after the push (novox/hq issue 92).
+	trusted, err := TrustTheRegistry(ctx, o, sys, d.Run, say)
+	result.RegistryTrusted = trusted
+	if err != nil {
+		return Published{}, failed(StepRegistry, err)
+	}
+	registry, err := InstallRegistry(ctx, o, d, temporary, say)
+	result.Registry, result.RegistryRunning = registry.Address, registry.Container
+	result.RegistryKnown, result.RegistryReplied = registry.Known, registry.Answered
+	if err != nil {
+		return Published{}, failed(StepRegistry, err)
+	}
+
+	// ---- 8. publish -----------------------------------------------------------------------
+	say("publish — the control plane's image gets its first manifest digest")
+	// **The image this mesh built, not the one the installer carried.** The carried one is the
+	// builder; publishing it here would put a builder in the registry under the control plane's
+	// name and install it as the control plane — which is exactly what happened the first time
+	// this ran, and presented as a control plane that started, printed a builder's usage, and
+	// exited cleanly over and over.
+	published, err := PublishControlPlane(ctx, o, d, controlPlaneImage, say)
+	result.PublishedAs, result.PublishedAlready = published.Reference, published.Already
+	if err != nil {
+		return published, failed(StepPublish, err)
+	}
+	return published, nil
+}