bootstrap: the slot the installer fills is not a registry to reach for

The first real run of mesh-bootstrap stopped in preflight, dialling 192.0.2.250:5000
for ninety seconds on a machine whose network was fine. That address is the registry
the lab used to raise; the substrate template still names the control plane by it,
and step 3 replaces that reference with the id of the image this installer carries.
Nothing ever pulls it.

So preflight excludes the control plane's resource by identity, rather than by the
happy accident of the template filling its slot with something that needs no registry.
Every other container's registry is still dialled, because those are somebody else's
images at somebody else's registry and a machine that cannot reach one fails inside a
pull, which says the wrong thing.

Also: `make bootstrap` takes BOOTSTRAP_OUT. The lab now builds the installer from
source before every raise, into a path it chooses, and a caller that could not say
where the output goes would have to copy it afterwards.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

internal/bootstrap/preflight_test.go

@@ -100,6 +100,31 @@ func TestOnlyTheRegistriesTheBundleNamesAreAskedAbout(t *testing.T) {
 	}
 }
 
+// And the control plane's slot is excluded whatever is in it.
+//
+// Found on the first real run of this installer. A template names the control plane by SOMETHING
+// and step 3 replaces it with the id of the carried image, so whatever was there is never pulled —
+// but preflight was reading that slot like any other and dialling it. The lab's template still
+// carried the address of a registry the lab no longer raises, so a correct install timed out in
+// preflight against a machine with a perfectly good network.
+func TestTheControlPlanesOwnRegistryIsNeverAskedAbout(t *testing.T) {
+	parsed, err := declaration.ParseFileTrusted([]byte(`{"declaration":1,"resources":[
+	  {"id":"store","type":"container","name":"mesh-store","image":"postgres@sha256:` +
+		strings.Repeat("7", 64) + `"},
+	  {"id":"control-plane","type":"container","name":"mesh-control","image":"192.0.2.250:5000/mesh-control@sha256:` +
+		strings.Repeat("8", 64) + `"}
+	]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got := registriesIn(parsed)
+	if len(got) != 1 || got[0] != DefaultRegistry {
+		t.Fatalf("asked about %v; the control plane's own reference is about to be replaced and "+
+			"must not be reached for", got)
+	}
+}
+
 func TestWhereAnImageWouldBeFetchedFrom(t *testing.T) {
 	// The container runtime's own rule: the part before the first slash is a registry host if it
 	// has a dot, a port, or is localhost. Getting this wrong means dialling a hostname that is