Scenarios: egress where images are needed, and images: cut to what is ours

Every scenario that places a container runtime gives each of its machines
`egress: true` — a node that runs modules pulls images from the internet, which is what
a node does. The underlay-only scenarios (bootstrap-single, behind-nat,
segmented-and-unforwardable, the-ordinary-shape, two-on-a-segment) stay sealed on
purpose: an extra NIC would change the very reachability they are asserting about.

`images:` keeps only the mesh's own — 55 third-party entries leave whole-mesh-full
alone, and the machine fetches them itself by the digest its module.json already pins.
The whole-mesh beds also say per machine which of ours they get: novox the substrate
control plane and its own fifteen runtimes, ace its twenty-four, the two workstations
one each. That is not a lab economy. An operator's workstation holds the images its own
modules need, and giving these two the union would put some thirty gigabytes onto a
thirty-gigabyte disk.

bootstrap-with-registry.yml is deleted. It existed only to demonstrate the lab's
registry, nothing referenced it, and there is nothing left for it to demonstrate.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

scenarios/schedule-tick.yml

@@ -15,8 +15,8 @@
 #   - it fires AGAIN on the following minute — recurrence, not a one-shot.
 #
 #   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_MODULES=.../mesh-control/examples/modules
-#   alpine:latest must be in the local daemon; the scenario stocks it into its own registry and
-#   serves it by digest, which is what the scheduled container declares (via pinned("alpine")).
+#   alpine:latest must be in the local daemon; the machine pulls it from the internet over its
+#   uplink, and the scheduled container declares it exactly as the catalogue writes it.
 #   There is no runtime image: schedtest carries no code of its own — the scheduled container is a
 #   bare alpine that runs `date >> /data/runs.log` and exits.
 scenario: schedule-tick
@@ -29,21 +29,15 @@ segments:
 machines:
   anchor:
     at: { segment: hosting, address: [192.0.2.10] }
+    egress: true
     inbound: allow
     memory: 3GiB
     cpus: 2
 
 images:
-  # The first-node substrate: store, broker, control.
-  - postgres:17-alpine
-  - cloudamqp/lavinmq:latest
   - mesh-control:development
-  # The tick container's image. schedtest has no runtime of its own — its scheduled container is a
-  # bare alpine that appends a timestamp and exits. alpine:latest must be in the local daemon; the
-  # scenario stocks it and serves it by digest, which is what the manifest pins via pinned("alpine").
-  - alpine:latest
 
 place:
-  # Only the host — schedtest has no mesh-runtime to place. The tick image is served by the
-  # scenario's registry and pulled by the host, not placed inside the machine.
+  # Only the host — schedtest has no mesh-runtime to place. The tick image is pulled from the
+  # internet by the host over its uplink, not placed inside the machine.
   all: [host]