The lab stands in for the builder on an upstream artifact too: the reference the manifest pins

hello-web's server is somebody else's image the mesh would copy in (ADR 0096); the
loader refused it as an artifact nobody stocked.

test/catalogue-module.test.ts

@@ -85,3 +85,17 @@ test("a manifest the catalogue does not have is refused by name", () => {
     assert.throws(() => catalogueModule("nothing", held), /no manifest for nothing/);
   } finally { restore(); }
 });
+
+test("an upstream artifact resolves to the reference the manifest pins, as the machine pulls it", () => {
+  const web = {
+    module: "thing", version: "1",
+    resources: [{ id: "server", type: "container", name: "web", artifact: "server" }],
+    build: { artifacts: [{ name: "server", kind: "upstream", from: "alpine@" + digest("e") }] },
+  };
+  const restore = aCatalogueWith(web);
+  try {
+    const m = JSON.parse(catalogueModule("thing", held)) as { resources: Record<string, unknown>[] };
+    assert.equal(m.resources[0]!["image"], "alpine@" + digest("e"));
+    assert.equal(m.resources[0]!["artifact"], undefined);
+  } finally { restore(); }
+});