Scenarios: egress where images are needed, and images: cut to what is ours

Every scenario that places a container runtime gives each of its machines
`egress: true` — a node that runs modules pulls images from the internet, which is what
a node does. The underlay-only scenarios (bootstrap-single, behind-nat,
segmented-and-unforwardable, the-ordinary-shape, two-on-a-segment) stay sealed on
purpose: an extra NIC would change the very reachability they are asserting about.

`images:` keeps only the mesh's own — 55 third-party entries leave whole-mesh-full
alone, and the machine fetches them itself by the digest its module.json already pins.
The whole-mesh beds also say per machine which of ours they get: novox the substrate
control plane and its own fifteen runtimes, ace its twenty-four, the two workstations
one each. That is not a lab economy. An operator's workstation holds the images its own
modules need, and giving these two the union would put some thirty gigabytes onto a
thirty-gigabyte disk.

bootstrap-with-registry.yml is deleted. It existed only to demonstrate the lab's
registry, nothing referenced it, and there is nothing left for it to demonstrate.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

scenarios/two-node-db.yml

@@ -21,6 +21,7 @@ machines:
   # containers on a node, which this one never does.
   anchor:
     at: { segment: hosting, address: [192.0.2.10] }
+    egress: true
     inbound: allow
     memory: 4GiB
     cpus: 4
@@ -31,25 +32,18 @@ machines:
   # so — and convergence would present as "the mesh hangs". Six gigabytes gives it room.
   laptop:
     at: { segment: hosting, address: [192.0.2.20] }
+    egress: true
     inbound: allow
     memory: 6GiB
     cpus: 4
     # The runtime images (280MB–600MB each) plus the service images — two of them heavy app images
-    # (Baserow ~1.5GB, Letta ~1.8GB) — are pulled from the scenario's own registry by digest, so the
+    # (Baserow ~1.5GB, Letta ~1.8GB) — are pulled from the internet over the uplink, so the
     # same bytes land on this node twice. The pool default root disk exhausts mid-apply ("no space
     # left on device"); sixty gigabytes holds the whole chain.
     disk: 60GiB
 
 images:
-  # The first-node substrate: store, broker, control. postgres:17-alpine doubles as postgres's own
-  # service image.
-  - postgres:17-alpine
-  - cloudamqp/lavinmq:latest
   - mesh-control:development
-  # The module service images.
-  - redis:7-alpine
-  - baserow/baserow:latest
-  - letta/letta:latest
   # The per-module runtimes, built by scripts/build-module-runtime.sh and stocked here. Each carries
   # its module's provisioner, so no separate mesh-provision-* image is listed — the runtime is the
   # provisioner (ADR 0048).