Three failures, all mine, all worth having

**A password beginning with a dash broke the search for it.** The
credential test greps the machine's own files for the delivered
password; this run's password started `-S`, so grep read it as an option
and refused the whole invocation. The test compared the usage message
against "0" and reported the password as leaked. That is the worst way
for a search to fail — it says it found something. Fixed with `-e` and
`--`, which is what those exist for.

**The planning test could not redirect what the scenario does not
serve.** Rewriting an image reference only works for repositories the
scenario's registry actually holds, and the object store's provisioner
was not stocked — so that module kept its placeholder and the refusal
fired, correctly. It is stocked now, so all five are planned again. The
skip path stays for anything genuinely unserved, and says which module
and why: a planning test quietly covering four instead of five is the
false coverage this suite exists to prevent.

**The forge failed because of the one above it.** The planning test
threw before its cleanup could run, leaving a module assigned that
refused the next push, so no database container was ever created.
Yesterday's fix moved that cleanup where a failure cannot skip it — but
`after` still only unassigns what was assigned, so it now tracks what
actually got added rather than what was intended.

scenarios/two-nodes.yml

@@ -40,6 +40,9 @@ images:
   - mesh-provision-postgres:development
   # And the proxy, which is what turns a route grant into traffic actually arriving.
   - mesh-route-proxy:development
+  # And the object store's provisioner, so the module describing it can be planned. Without it
+  # that module still names an image nothing serves, and planning it is refused — correctly.
+  - mesh-provision-objectstore:development
   # And a forge, so one of the real module descriptions can be started rather than only planned.
   # It is the first of them to run: it needs a database from another module, a credential it did
   # not choose, and a connection string it could not have written itself.