Scenarios: egress where images are needed, and images: cut to what is ours

Every scenario that places a container runtime gives each of its machines
`egress: true` — a node that runs modules pulls images from the internet, which is what
a node does. The underlay-only scenarios (bootstrap-single, behind-nat,
segmented-and-unforwardable, the-ordinary-shape, two-on-a-segment) stay sealed on
purpose: an extra NIC would change the very reachability they are asserting about.

`images:` keeps only the mesh's own — 55 third-party entries leave whole-mesh-full
alone, and the machine fetches them itself by the digest its module.json already pins.
The whole-mesh beds also say per machine which of ours they get: novox the substrate
control plane and its own fifteen runtimes, ace its twenty-four, the two workstations
one each. That is not a lab economy. An operator's workstation holds the images its own
modules need, and giving these two the union would put some thirty gigabytes onto a
thirty-gigabyte disk.

bootstrap-with-registry.yml is deleted. It existed only to demonstrate the lab's
registry, nothing referenced it, and there is nothing left for it to demonstrate.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

scenarios/lavinmq-bed.yml

@@ -22,8 +22,8 @@
 #   scripts/build-module-runtime.sh lavinmq   /tmp/lavinmq.tar
 #   scripts/build-module-runtime.sh amqp-ping /tmp/amqp-ping.tar
 # The service image cloudamqp/lavinmq:latest must be in the local daemon too — it is already stocked as
-# the substrate's own broker image; each node pulls what it runs from the scenario's own registry by
-# digest.
+# the substrate's own broker image; each node pulls what it runs from the internet, over its own
+# uplink.
 scenario: lavinmq-bed
 
 segments:
@@ -34,23 +34,22 @@ segments:
 machines:
   anchor:
     at: { segment: hosting, address: [192.0.2.10] }
+    egress: true
     inbound: allow
     memory: 3GiB
     cpus: 2
   laptop:
     at: { segment: hosting, address: [192.0.2.11] }
+    egress: true
     inbound: allow
     memory: 3GiB
     cpus: 2
 
 images:
-  # The first-node substrate: store, broker (itself lavinmq), control.
-  - postgres:17-alpine
-  - cloudamqp/lavinmq:latest
   - mesh-control:development
   # The lavinmq provider's runtime (reused for its run-once bootstrap and its provisioner) and the
   # amqp-ping consumer's runtime, both built by scripts/build-module-runtime.sh into the local daemon
-  # and stocked into the scenario's own registry, which is where the hosts pull them from by digest.
+  # and loaded onto the machines, which hold them by their own image IDs.
   # The lavinmq SERVICE image is cloudamqp/lavinmq:latest, already stocked above.
   - mesh-runtime-lavinmq:development
   - mesh-runtime-amqp-ping:development