WIP: catalogue-apps install bed (mongodb, unifi, marrytts)

Adds the mongodb runtime CLI (mongosh) to build-module-runtime.sh, a
catalogue-apps scenario, and its install test. Proven so far: the ADR-0054 slug
applies and the mesh accepts the push (mongodb consumer identity mesh_anchor_mongo
fits). NOT green: the node applies but never reaches 'current' within 1200s — a
persistent reconcile divergence (applied-but-never-current, no crash), likely a
module declaring a resource its container mutates (issue-011 class). Needs live
VM inspection to name the module. Not merged.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

scripts/build-module-runtime.sh

@@ -41,6 +41,9 @@ EXTRA=""
 case "$MODULE" in
   postgres) EXTRA='RUN apt-get update && apt-get install -y --no-install-recommends postgresql-client && rm -rf /var/lib/apt/lists/*' ;;
   minio)    EXTRA='COPY --from=minio/mc:latest /usr/bin/mc /usr/bin/mc' ;;
+  # mongodb's client shells out to `mongosh`. Install it from MongoDB's own apt repo so its shared
+  # libraries come with it — copying just the binary out of the mongo image leaves it unable to load.
+  mongodb)  EXTRA='RUN apt-get update && apt-get install -y --no-install-recommends gnupg curl ca-certificates && curl -fsSL https://pgp.mongodb.com/server-7.0.asc | gpg --dearmor -o /usr/share/keyrings/mongodb.gpg && echo "deb [signed-by=/usr/share/keyrings/mongodb.gpg] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" > /etc/apt/sources.list.d/mongodb.list && apt-get update && apt-get install -y --no-install-recommends mongodb-mongosh && rm -rf /var/lib/apt/lists/*' ;;
 esac
 
 cat > "$STAGE/Dockerfile" <<DOCKER