catalogue-mqtt: prove the run-once primitive end to end

A bed that assigns mosquitto and asserts the run-once step seeded dynsec
before the broker: the bootstrap ran to completion (not left running), the
seed is on disk owned by the broker's uid, the broker is up and stable
(it crash-loops against an unseeded store, so a stable broker is the proof),
and the node reached current. On top, the seeded admin authenticates over
MQTT and the provisioner grants a scoped client a consumer connects with.

build-module-runtime.sh gains a mosquitto arm (install mosquitto_ctrl from
the mosquitto package — it is not in mosquitto-clients on bookworm, and a
musl binary from eclipse-mosquitto would not load) and compiles the module's
bootstrap/index.ts entrypoint.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

scripts/build-module-runtime.sh

@@ -21,7 +21,7 @@ BASE="${RUNTIME_BASE:-node:22-bookworm-slim}"
 ( cd "$MESH_SDK" && npm run build >/dev/null )
 ( cd "$MESH_TOOLS" && npm run build >/dev/null )
 # Compile whichever of the module's entrypoints exist.
-SRCS=(); for f in client.ts index.ts tools/index.ts provisioner/index.ts; do [ -f "$MOD/$f" ] && SRCS+=("$f"); done
+SRCS=(); for f in client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts; do [ -f "$MOD/$f" ] && SRCS+=("$f"); done
 TSC="$MESH_SDK/node_modules/.bin/tsc"; ( cd "$MOD" && "$TSC" "${SRCS[@]}" --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist >/dev/null )
 
 STAGE="$(mktemp -d)"; trap 'rm -rf "$STAGE"' EXIT
@@ -41,6 +41,11 @@ EXTRA=""
 case "$MODULE" in
   postgres) EXTRA='RUN apt-get update && apt-get install -y --no-install-recommends postgresql-client && rm -rf /var/lib/apt/lists/*' ;;
   minio)    EXTRA='COPY --from=minio/mc:latest /usr/bin/mc /usr/bin/mc' ;;
+  # mosquitto drives its dynsec admin — and its run-once bootstrap seeds the store — through
+  # `mosquitto_ctrl`. It is not in `mosquitto-clients` on bookworm; the `mosquitto` package carries
+  # it (with its shared libraries), and installing from apt keeps them together — copying the binary
+  # out of the (musl) eclipse-mosquitto image into this (glibc) base would not load.
+  mosquitto) EXTRA='RUN apt-get update && apt-get install -y --no-install-recommends mosquitto && rm -rf /var/lib/apt/lists/*' ;;
   # mongodb's client shells out to `mongosh`. Install it from MongoDB's own apt repo so its shared
   # libraries come with it — copying just the binary out of the mongo image leaves it unable to load.
   mongodb)  EXTRA='RUN apt-get update && apt-get install -y --no-install-recommends gnupg curl ca-certificates && curl -fsSL https://pgp.mongodb.com/server-7.0.asc | gpg --dearmor -o /usr/share/keyrings/mongodb.gpg && echo "deb [signed-by=/usr/share/keyrings/mongodb.gpg] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" > /etc/apt/sources.list.d/mongodb.list && apt-get update && apt-get install -y --no-install-recommends mongodb-mongosh && rm -rf /var/lib/apt/lists/*' ;;