The whole-mesh bed installs the vault before the modules that keep a secret from it; route-forwarding waits on issue 076

test/beds-read-the-catalogue.test.ts

@@ -57,7 +57,7 @@ const STILL_CARRIED: Record<string, { modules: string[]; why: string }> = {
   "provider-uses-mesh-credential.test.ts": { modules: ["redis"], why: "WEARING: a credential mechanism test" },
   "runtime-restart-on-config.test.ts": { modules: ["grafana"], why: "WEARING: a restart mechanism test" },
   "route-forwarding.test.ts": { modules: ["route-proxy", "hello-web"],
-    why: "WEARING: route-proxy without its certificate authority, hello-web with the route shape ADR 0066 replaced" },
+    why: "WEARING: route-proxy without its certificate authority, hello-web with the route shape ADR 0066 replaced — waits on novox/hq 04-ISSUES/076 (step-ca's root is a minted secret, so the catalogue's authority cannot be raised beside the proxy yet)" },
   "mesh.test.ts": { modules: ["postgres", "builder", "umami"],
     why: "WEARING: a postgres with no resources, a builder that builds itself, an umami that is another module of that name" },
 };