Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk
carries no composition rule. The catalogue functions only the
node-engine's composition reaches (Resolve, Resolution's Compose,
Declaration, DataItems, LeftOut, Rules and the rest, the settings,
placeholder and template refusals, the rendering helpers) are copied
with their tests into internal/compose/resolution; a method of a
mesh-sdk shape becomes a function taking it first. The composition
calls its own copies, and the captured catalogue its tests read lives
here now, shared by mesh-compose's tests.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

internal/compose/resolution/resolve_loopback_test.go

@@ -0,0 +1,54 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A MESH-SCOPED provider on the consumer's own node must deliver a usable address too.
+//
+// The sibling case — a node-scoped provider minting no credential — has had this fallback and a
+// test for it for some time. This branch did not, and the difference is invisible until something
+// puts the address into a string: the mesh's own artifact store is mesh-scoped and lives on the
+// same machine as the builder that pushes to it, so the builder's environment was written as
+// `MESH_REGISTRY=:5000`. Nothing refused it. The runtime did, several steps later, with
+// `":5000/mesh-tools/build" is not a valid repository/tag` — a message about a tag, for a fault in
+// how a binding was resolved.
+//
+// A machine off the private network still reaches itself.
+func TestAMeshScopedProviderOnThisNodeStillCarriesAnAddress(t *testing.T) {
+	provider := mcat.Manifest{Module: "registry",
+		Provides: []mcat.Offer{{Name: "artifact-store", Scope: mcat.ScopeMesh}},
+		Serves: map[string]map[string]any{
+			"artifact-store": {"port": 5000}}}
+	consumer := mcat.Manifest{Module: "builder", Requires: []string{"artifact-store"}}
+
+	// No `At`: a mesh with no private network raised, which is every mesh before somebody places
+	// its nodes on one — including the moment just after it is installed.
+	got, err := Resolve(
+		map[string]mcat.Manifest{"registry": provider, "builder": consumer},
+		[]string{"builder", "registry"}, mcat.Node{Name: "anchor"}, mcat.World{})
+	if err != nil {
+		t.Fatalf("a mesh-scoped provision answered on this very node was refused: %v", err)
+	}
+
+	var found *mcat.Needed
+	for i := range got.Needs {
+		if got.Needs[i].Name == "artifact-store" && got.Needs[i].For == "builder" {
+			found = &got.Needs[i]
+		}
+	}
+	if found == nil {
+		t.Fatalf("the store was not delivered to the builder at all: %+v", got.Needs)
+	}
+	if found.At == "" {
+		t.Fatalf("the binding carries no address, so anything composing a host from it gets none: %+v", found)
+	}
+	if found.At != "127.0.0.1" {
+		t.Fatalf("off the private network the address must fall back to loopback, got %q", found.At)
+	}
+	if got, want := plainly(found.Serves["port"]), "5000"; got != want {
+		t.Fatalf("the port was not delivered: got %q want %q", got, want)
+	}
+}