A real bundle: a bare machine raises a store and a database

The first three steps of the substrate bootstrap, run on a lab machine
confirmed to have no route out. It went from bare to a container runtime
installed and enabled, PostgreSQL running from an image pinned by digest, and
the control plane's database created inside it -- from the file the host
carries, with nothing to ask.

Second run changed nothing. `owned` lists all five afterwards, and `mesh` is in
the store.

It stops before the last two steps because there is no control plane yet: its
schema cannot be loaded and its image does not exist. The bundle says so rather
than naming something that cannot be applied.

Two things fixed on the way.

`make host BUNDLE=...` still swapped a file called substrate.lock, which the
per-system split had renamed months of decisions ago -- it now takes SYSTEM and
replaces that system's bundle. And the .lock files still cited ADR 0060, since
the renumbering pass only covered .md, .go, .ts and .sh.

One thing learned by it failing first: a directory the host creates is owned by
root, and a database inside a container runs as somebody else, so it could not
write and the container crash-looped. The store's data is a named volume now,
which lets the image set up its own ownership and outlives the container --
which is what you want for the thing holding the mesh's state.

Worth noting the failure was caught by the action's verify rather than by the
container step. `docker inspect` reported the container running because it was,
briefly, between restarts. Running is not working, and the thing that knew the
difference was the step that asked the database whether it would answer.

internal/bundle/substrate-alpine.lock

@@ -1,7 +1,7 @@
 // substrate-alpine.lock — the pinned tier-1 descriptor the ALPINE host carries.
 //
 // Per system, because its CONTENTS are: this one names apk packages and OpenRC services where
-// the arch bundle names pacman packages and systemd units (novox/hq ADR 0060).
+// the arch bundle names pacman packages and systemd units (novox/hq ADR 0005).
 //
 // Empty on purpose. What belongs here is the closure for a one-node mesh, and that is not
 // yet known: novox/hq research 012 asks what the minimum actually is, and research 011 is

internal/bundle/substrate-android.lock

@@ -5,7 +5,7 @@
 //
 // The substrate is a container runtime, a store and the control plane (novox/hq
 // 07-the-substrate.md). An android host implements `file`, `directory` and `action` and refuses
-// `package`, `container` and `service` (ADR 0060) — so every step of the bootstrap is a shape it
+// `package`, `container` and `service` (ADR 0005) — so every step of the bootstrap is a shape it
 // does not have. No amount of filling this in changes that.
 //
 // **A partial host can JOIN a mesh and cannot BE the first node.** That is a real distinction

internal/bundle/substrate-arch.lock

@@ -1,7 +1,7 @@
 // substrate-arch.lock — the pinned tier-1 descriptor the ARCH host carries.
 //
 // Per system, because its CONTENTS are: package names, unit names and service names all differ
-// (novox/hq ADR 0060). The mechanism is shared; what it names is not.
+// (novox/hq ADR 0005). The mechanism is shared; what it names is not.
 //
 // Empty on purpose. What belongs here is the closure for a one-node mesh, and that is not
 // yet known: novox/hq research 012 asks what the minimum actually is, and research 011 is