Genesis registers the control plane with the manifest its build produced

The control plane's manifest existed twice: at the root of its repository, read
whenever the mesh rebuilds it from source, and as a copy in the catalogue, read by
genesis. Nothing kept them equal, and the first rebuild replaced the mesh's record
with the repository's shape while every later push was refused (novox/hq
04-ISSUES/072). The builder's one-shot result already carries the manifest it built,
artifact resolved to the image; step 3 keeps it and step 9 registers it, re-pinning
the built image's bare id to the reference the registry assigned. The catalogue is
still read for the registry's and the builder's manifests and for phase two.

internal/bootstrap/module.go

@@ -1,7 +1,9 @@
 package bootstrap
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -143,3 +145,67 @@ func pushNode(ctx context.Context, o Options, control controlPlane, say func(str
 	say("  pushed            " + o.Node)
 	return strings.TrimSpace(said), nil
 }
+
+// pinPlaceholder replaces the catalogue's placeholder digest with what the registry assigned — the
+// builder's manifest, which the catalogue still holds (the control plane's comes out of its own
+// build, see pinImage).
+//
+// **Textual, and every place it appears.** A manifest may name its image in more than one resource
+// — the catalogue's converted modules routinely carry a runtime container beside the application's
+// — and the same reasoning as the bundle rewrite applies: replacing one and not the others leaves
+// something pointing at an image nothing serves, and it fails half way through an apply rather
+// than here.
+//
+// It refuses a manifest with no placeholder in it. That is not pedantry: a manifest already
+// carrying a real digest is one somebody pinned by hand, and quietly registering it would install a
+// control plane that is not the image this machine just published — which is the one thing this
+// step exists to guarantee.
+func pinPlaceholder(manifest []byte, reference, module string) ([]byte, int, error) {
+	places := bytes.Count(manifest, []byte(placeholderDigest))
+	if places == 0 {
+		return nil, 0, fmt.Errorf(
+			"the %s module's manifest carries no placeholder digest (%s), so there is nothing to "+
+				"pin to the image this machine just published.\n"+
+				"A manifest already naming a digest was pinned by somebody else, to some other "+
+				"build. Registering it would install a module that is not the one this "+
+				"installer carried and pushed", module, placeholderDigest)
+	}
+	// The reference the registry gave back is `<registry>/<repository>@sha256:…`, and what the
+	// manifest holds is `<something>@sha256:0…0`. Replacing only the digest would leave the
+	// manifest's own repository name in front of it — which may be `mesh-controller` with no
+	// registry, and a runtime would then pull it from the internet. The whole reference moves.
+	var out bytes.Buffer
+	rest := manifest
+	for {
+		at := bytes.Index(rest, []byte(placeholderDigest))
+		if at < 0 {
+			out.Write(rest)
+			break
+		}
+		// Back up over the repository this digest belongs to, which runs to the opening quote.
+		start := bytes.LastIndexByte(rest[:at], '"')
+		if start < 0 {
+			return nil, 0, fmt.Errorf(
+				"the %s module's manifest has a placeholder digest that is not inside a JSON "+
+					"string, so the installer cannot tell what image it belongs to", module)
+		}
+		out.Write(rest[:start+1])
+		out.WriteString(reference)
+		rest = rest[at+len(placeholderDigest):]
+	}
+	pinned := out.Bytes()
+
+	// Read back. A substitution on text can catch more than it was aimed at, and the manifest is
+	// about to be handed to the mesh as the description of what it runs.
+	var checked map[string]any
+	if err := json.Unmarshal(pinned, &checked); err != nil {
+		return nil, 0, fmt.Errorf(
+			"pinning the %s module's image broke its manifest: %w", module, err)
+	}
+	if bytes.Contains(pinned, []byte(placeholderDigest)) {
+		return nil, 0, fmt.Errorf(
+			"the %s module's manifest still carries a placeholder digest after pinning",
+			module)
+	}
+	return pinned, places, nil
+}