Genesis raises the package registry before it builds the base

The base (mesh-tools) resolves the SDK by version from the mesh's package
registry rather than cloning it from a git URL (hq ADR 0076, issue 053), so the
registry has to answer and the SDK has to be in it before the base build runs.

New steps, before base: seed gitea's database in the substrate store, raise
gitea's server on it, create the admin/org/team and the builder's account, seal
the builder its registry credential, and publish the SDK on a public base. gitea
is adopted as an ordinary module after the base, so its provisioner image can be
built. A minimal Go gitea admin client stands in until that module exists.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/bootstrap/bootstrap.go

@@ -53,6 +53,8 @@ const (
 	StepControlPlane Step = "control-plane"
 	StepRetire       Step = "retire"
 	StepBuilder      Step = "builder"
+	StepPackages     Step = "packages"
+	StepSDK          Step = "sdk"
 	StepBase         Step = "base"
 	StepStore        Step = "store"
 	StepCatalogue    Step = "catalogue"
@@ -75,6 +77,7 @@ const (
 var Steps = []Step{
 	StepPreflight, StepLoad, StepBuild, StepBundle, StepApply, StepVerify,
 	StepEnrol, StepRegistry, StepPublish, StepControlPlane, StepRetire, StepBuilder,
+	StepPackages, StepSDK,
 	// Phase two. The twelve above make a mesh that RUNS; these make one that WORKS — able to
 	// build, to say what it holds, on its network, filtering. They used to be things somebody
 	// typed afterwards, which is how they went missing without anything complaining.
@@ -164,6 +167,9 @@ type Options struct {
 	// CatalogSource is where the catalogue REPOSITORY is, for building its modules. The catalogue
 	// CHECKOUT (Catalogue, above) says what a module is; this is where a builder clones it.
 	CatalogSource Source
+	// SDKSource is where the mesh's shared library is built from. It is published to the package
+	// registry before the base is built, because the base resolves it by version (novox/hq ADR 0076).
+	SDKSource Source
 	// Site is where this machine sits, for the private network's placement.
 	Site string
 	// Answers are the choices, answered by flag: name → answer. What a terminal would be asked.
@@ -563,6 +569,18 @@ func Run(ctx context.Context, o Options, d Deps, say func(string)) (Result, erro
 		return result, failed(StepBuilder, err)
 	}
 
+	// ---- packages — the registry, before the base that resolves the SDK from it ----------
+	say("packages — a registry answers, and the SDK is in it, before the base is built")
+	if err := RaisePackageRegistry(ctx, o, d, permanentControl, say); err != nil {
+		return result, failed(StepPackages, err)
+	}
+
+	// ---- sdk — published on a public base, so this needs no toolchain --------------------
+	say("sdk — the shared library, published by version so the base can resolve it")
+	if err := PublishTheSDK(ctx, o, permanentControl, say); err != nil {
+		return result, failed(StepSDK, err)
+	}
+
 	// ---- 13. base -------------------------------------------------------------------------
 	say("base — the shared toolchain and runtime everything with code stands on")
 	if err := BuildBase(ctx, o, permanentControl, say); err != nil {