Scenarios: egress where images are needed, and images: cut to what is ours

Every scenario that places a container runtime gives each of its machines
`egress: true` — a node that runs modules pulls images from the internet, which is what
a node does. The underlay-only scenarios (bootstrap-single, behind-nat,
segmented-and-unforwardable, the-ordinary-shape, two-on-a-segment) stay sealed on
purpose: an extra NIC would change the very reachability they are asserting about.

`images:` keeps only the mesh's own — 55 third-party entries leave whole-mesh-full
alone, and the machine fetches them itself by the digest its module.json already pins.
The whole-mesh beds also say per machine which of ours they get: novox the substrate
control plane and its own fifteen runtimes, ace its twenty-four, the two workstations
one each. That is not a lab economy. An operator's workstation holds the images its own
modules need, and giving these two the union would put some thirty gigabytes onto a
thirty-gigabyte disk.

bootstrap-with-registry.yml is deleted. It existed only to demonstrate the lab's
registry, nothing referenced it, and there is nothing left for it to demonstrate.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

scenarios/whole-mesh-novox.yml

@@ -17,9 +17,10 @@
 #
 #   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
 # The runtimes are built by scripts/build-module-runtime.sh (one per module that has code) and the
-# route-proxy image by scripts/build-route-proxy-image.sh; every server image must be in the local
-# daemon to be stocked. The test loads each committed module.json from mesh-catalog and rewrites its
-# image references to what this scenario's own registry serves by digest.
+# route-proxy image by scripts/build-route-proxy-image.sh; those must be in the local daemon,
+# because nothing serves them and nothing can. Every third-party image is pulled from the internet
+# over each node's uplink. The test loads each committed module.json from mesh-catalog and rewrites
+# only OUR image references, to the ID the machine holds each one under.
 scenario: whole-mesh-novox
 
 segments:
@@ -31,55 +32,48 @@ machines:
   # The substrate ONLY: store, broker, control. Nothing else lands here.
   anchor:
     at: { segment: hosting, address: [192.0.2.10] }
+    egress: true
     inbound: allow
     memory: 4GiB
     cpus: 4
     disk: 20GiB
+    # The substrate only, so the control plane's image only. Handing this machine the whole set of
+    # runtimes would fill a 20GiB disk with images nothing on it will ever start.
+    images: [mesh-control:development]
   # The whole novox service set — ~38 containers (five providers with runtimes, six consumers with
   # runtimes, portainer/verdaccio/registry/route-proxy, the nine-container Mailu stack and its
   # runtime) plus two node-level modules. mssql alone wants ~2GiB; Mailu, Nextcloud and Keycloak are
   # each heavy. Sized well past the two-node-db bed's second node.
   novox:
     at: { segment: hosting, address: [192.0.2.20] }
+    egress: true
     inbound: allow
     memory: 16GiB
     cpus: 8
-    # ~14GiB of images are pulled from the scenario's own registry by digest, several of them large
+    # ~14GiB of images are pulled from the internet over the uplink, several of them large
     # (mssql 1.7GiB, invoicing-api 1.9GiB, nextcloud 1.5GiB, umami/mongo ~0.9GiB), plus writable
     # layers and the runtimes. A hundred gigabytes holds the whole set without exhausting the disk
     # mid-apply.
     disk: 100GiB
+    # Every runtime, and the proxy. Not mesh-control: the control plane runs on the anchor.
+    images:
+      - mesh-runtime-postgres:development
+      - mesh-runtime-redis:development
+      - mesh-runtime-minio:development
+      - mesh-runtime-mongodb:development
+      - mesh-runtime-mssql:development
+      - mesh-runtime-keycloak:development
+      - mesh-runtime-gitea:development
+      - mesh-runtime-nextcloud:development
+      - mesh-runtime-umami:development
+      - mesh-runtime-photos:development
+      - mesh-runtime-portainer:development
+      - mesh-runtime-verdaccio:development
+      - mesh-runtime-mailu:development
+      - mesh-route-proxy:development
 
 images:
-  # The first-node substrate: store, broker, control. postgres:17-alpine doubles as the postgres
-  # provider's own service image (and Mailu's internal admin DB).
-  - postgres:17-alpine
-  - cloudamqp/lavinmq:latest
   - mesh-control:development
-  # The module server images. Each is stocked under the repository path its module.json names, so the
-  # test's rewrite (pinned(repositoryFor(image))) finds it.
-  - redis:7-alpine
-  - minio/minio:latest
-  - mongo:7
-  - mcr.microsoft.com/mssql/server:2022-latest
-  - quay.io/keycloak/keycloak:mesh
-  - gitea/gitea:1.22
-  - nextcloud:stable
-  - ghcr.io/umami-software/umami:postgresql-latest
-  - alpine:latest
-  - portainer/portainer-ce:latest
-  - verdaccio/verdaccio:6
-  - registry:2
-  - registry-api.novox.be/novox/invoicing-app:latest
-  - registry-api.novox.be/novox/invoicing-api:latest
-  # The Mailu stack (pulled by digest, tagged :mesh so repositoryFor matches the module.json paths).
-  - ghcr.io/mailu/unbound:mesh
-  - ghcr.io/mailu/admin:mesh
-  - ghcr.io/mailu/dovecot:mesh
-  - ghcr.io/mailu/postfix:mesh
-  - ghcr.io/mailu/rspamd:mesh
-  - ghcr.io/mailu/webmail:mesh
-  - ghcr.io/mailu/nginx:mesh
   # The per-module runtimes (built by scripts/build-module-runtime.sh). registry, route-proxy,
   # invoicing, firewall and fail2ban carry no mesh-runtime image; route-proxy ships its own.
   - mesh-runtime-postgres:development