The cache edge, proven end to end

A consumer contributes a key prefix and gets an ACL user; the test is
that the grant means exactly what the manifest said, in both
directions: its own keys usable, anyone else's refused by the store
itself, and the flush a tenant must never have refused with them.

Waited for through the store rather than through logs: the user list,
asked with the password the host wrote into the server's own conf file
on the machine — nothing invented, both ends reading what the mesh
delivered.

And the forge is asked on the port the mesh assigned, not the one the
module declared. The old curl aimed at 3000, which was right until
ADR 0038 moved the machine side — a latent break that would have fired
on the first run to get past the settling that used to fail first.

The scenario stocks redis and its provisioner, and the rebuild builds
the provisioner image with the others.

test/rebuild.test.ts

@@ -32,7 +32,8 @@ test("every image the lab runs is rebuilt, not only the control plane's", () =>
   const images = builds.find((b) => b.what === "images");
   assert.ok(images, "no image build at all");
   for (const target of [
-    "image", "builder-image", "provisioner-image", "objectstore-image", "proxy-image",
+    "image", "builder-image", "provisioner-image", "objectstore-image",
+    "redis-provisioner-image", "proxy-image",
   ]) {
     assert.ok(images.argv.includes(target), `${target} is never built, so the lab runs a stale one`);
   }