Automate the lab registry: a sealed machine pulls by digest

Closes 04-ISSUES/009. A scenario declares `images:` by tag; the lab stocks a
registry on this workstation where there is a network, raises it inside the
scenario as scenery, and reports the references a declaration pins -- which are
the digests THIS registry assigned, and are not knowable until it is raised.

Verified in a sealed machine, confirmed by ping to have no route out: package,
service including boot state, a container pinned by digest, and an action
inside that container. Applied, idempotent on re-apply, and read back from the
machine rather than from the apply's own report. That is the first time the
container shape has worked in the lab at all, and it was the shape blocking the
substrate bootstrap.

Four faults found by running it, three of them mine and one worth keeping:

The read-back checked that the catalog endpoint answered, by looking for the
substring "repositories" -- which `{"repositories":[]}` also contains. So it
passed on a registry holding nothing, and the failure surfaced much later as a
container that could not be pulled. It now asks for each image's manifest BY
DIGEST, which is what a machine does.

A recursive push needs its destination to exist, or incus copies the source's
contents rather than the source. The data landed one directory too shallow and
the registry found nothing where it looks.

The registry writes its blobs as root through a bind mount, so the workstation
could not remove its own scratch directory afterwards. Whoever made the files
removes them -- the cleanup now runs in a container too. And a cleanup failure
no longer fails a raise that succeeded: the scenario is standing and usable,
and saying otherwise would be a false report.

The base image build did not verify that the runtime trusts the documentation
ranges as plain-HTTP registries. Writing the file is not the daemon honouring
it, and a base image that looks right fails much later, in a sealed scenario,
a long way from its cause. It is now read back from `docker info`.

src/lifecycle/base.ts

@@ -85,6 +85,23 @@ export async function buildBaseImage(
     }
     log(`  runtime works (docker ${runtime})`);
 
+    // Read back that the runtime will actually pull over plain HTTP from a documentation
+    // range. Writing the file is not the same as the daemon honouring it, and a base image
+    // that looks right here fails much later — in a sealed scenario, as a container that
+    // cannot fetch its image, which is a long way from the cause.
+    const trusted = await incusOk(
+      ["exec", BUILDER, "--", "docker", "info", "--format", "{{.RegistryConfig.InsecureRegistryCIDRs}}"],
+      60_000,
+    );
+    if (!trusted?.includes("192.0.2.0/24")) {
+      throw new BaseImageError(
+        `the runtime in ${BUILDER} does not trust the documentation ranges as plain-HTTP ` +
+          `registries. It reported: ${trusted?.trim() || "nothing"}\n` +
+          `  Every scenario raised from this image would fail to pull from its own registry.`,
+      );
+    }
+    log("  trusts the documentation ranges as registries");
+
     log("  publishing");
     await incus(["stop", BUILDER, "--timeout", "120"], 300_000);
     await incus(["publish", BUILDER, "--alias", BASE_IMAGE_ALIAS, "--reuse"], 900_000);