An image the machine has no account for is handed over, not fetched

Deleting the lab's registry left the operator's own images to be pulled like
anything else, and they cannot be: their registry wants an account and a
scenario machine has none. The pull fails with 'no basic auth credentials',
which is not something more patience fixes.

So the test is no longer 'did the mesh build it' but 'can the machine get it at
all'. Two ways to fail that — published nowhere, or published somewhere the
machine cannot authenticate to — and one consequence: the workstation, which
does hold the credential, exports it and loads it.

Worth saying what this stands in for. In a finished mesh these are built by the
builder and published to the mesh's own store, and every machine pulls them from
there with a credential the mesh granted. Until that store exists there is
nowhere for them to come from, and handing them over is the closest honest thing
— not a registry the lab invents, which is what was just removed.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

test/pinning.test.ts

@@ -2,7 +2,8 @@ import { test } from "node:test";
 import assert from "node:assert/strict";
 
 import {
-  isMeshBuilt, pinnedInto, referenceFor, repositoryOf, stillUnpinned, type HeldImage,
+  isMeshBuilt, mustBeHandedOver, pinnedInto, referenceFor, repositoryOf, stillUnpinned,
+  type HeldImage,
 } from "../src/pinning.ts";
 
 /**
@@ -134,3 +135,30 @@ test("what is still a placeholder can be named", () => {
   const text = `"image": "something-of-ours@sha256:${"0".repeat(64)}"`;
   assert.deepEqual(stillUnpinned(text), ["something-of-ours"]);
 });
+
+/**
+ * An image a machine cannot fetch by itself has to be handed to it, and there are two ways to be in
+ * that position: built here and published nowhere, or sitting in a registry the machine has no
+ * account for. The second was found by deleting the lab's registry — the operator's own images
+ * failed with `no basic auth credentials`, which no amount of retrying improves.
+ */
+test("an image the machine cannot fetch by itself is handed over", () => {
+  for (const handed of [
+    "mesh-control:development",
+    "mesh-runtime-plex:development",
+    `registry.example/novox/www@sha256:${"a".repeat(64)}`,
+    "registry.example:5000/novox/photos-server:latest",
+  ]) {
+    assert.ok(mustBeHandedOver(handed), `${handed} cannot be fetched and was not handed over`);
+  }
+  for (const fetched of [
+    "postgres:17-alpine",
+    "gitea/gitea:1.22",
+    "ghcr.io/mailu/admin:1.9",
+    "quay.io/keycloak/keycloak:26",
+    "lscr.io/linuxserver/sonarr:latest",
+    "mcr.microsoft.com/mssql/server:2022-latest",
+  ]) {
+    assert.ok(!mustBeHandedOver(fetched), `${fetched} can be fetched and was handed over anyway`);
+  }
+});