Phase 3.1: adopt the foundation store as the postgres module

InstallStore turns the mesh-store the foundation raised at genesis into the
postgres module, adopted in place: it verifies the module's server names the
same container and the same image the foundation is running (fail-fast on a
drift, rather than tearing down the mesh's store), then registers, builds the
provisioner, and carries the superuser in via secret accept — the mesh cannot
invent a credential that already made the databases (mirroring the control
plane's store-connection delivery, control.go). pinImage generalised to any
module for reuse.

Issue 051 (WBS 3.1). One server holds the controller's contexts and every
module's database.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/bootstrap/control_test.go

@@ -63,7 +63,7 @@ const pushedReference = "127.0.0.1:5000/mesh-controller@sha256:" +
 // with no registry in front — which a runtime would go to the internet for, and this mesh's
 // control plane exists in no public registry by design.
 func TestTheControlPlaneIsPinnedToWhatThisMeshsRegistryAssigned(t *testing.T) {
-	pinned, places, err := pinImage([]byte(theControlPlaneModule), pushedReference)
+	pinned, places, err := pinImage([]byte(theControlPlaneModule), pushedReference, "mesh-controller")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -85,7 +85,7 @@ func TestTheControlPlaneIsPinnedToWhatThisMeshsRegistryAssigned(t *testing.T) {
 func TestAManifestAlreadyPinnedByHandIsRefused(t *testing.T) {
 	already := strings.Replace(theControlPlaneModule, placeholderDigest,
 		"sha256:"+strings.Repeat("9", 64), 1)
-	if _, _, err := pinImage([]byte(already), pushedReference); err == nil {
+	if _, _, err := pinImage([]byte(already), pushedReference, "mesh-controller"); err == nil {
 		t.Fatal("a manifest already pinned to some other image was accepted")
 	}
 }
@@ -100,7 +100,7 @@ func TestEveryPlaceTheManifestNamesTheImageIsPinned(t *testing.T) {
      {"id": "migrate", "type": "container", "name": "mesh-controller-migrate", "run-once": true,
       "image": "mesh-controller@`+placeholderDigest+`", "args": ["migrate"]},`, 1)
 
-	pinned, places, err := pinImage([]byte(twice), pushedReference)
+	pinned, places, err := pinImage([]byte(twice), pushedReference, "mesh-controller")
 	if err != nil {
 		t.Fatal(err)
 	}