Raise a mesh of one by the installer, in a bed of its own

The four-node bed proves genesis entangled with three machines joining across a
gateway, so the cheapest check of the install path costs a four-machine raise.
This is genesis alone: one machine, the installer, and the question asked of the
machine rather than inferred from an exit code.

Genesis moves into a shared routine both beds call, rather than being described a
second time here — a second description kept in step with the first is what put
the whole procedure inside a fixture to begin with.

The scenario needs two things the first draft missed, and both cost a full raise
to discover: a way out to the internet, because the installer's first act is to
pull the substrate; and a container runtime, because the installer's first refusal
is a machine that has none.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

scenarios/genesis-single.yml

@@ -0,0 +1,40 @@
+# GENESIS, on its own: one machine, no mesh, and the installer.
+#
+# The smallest thing that proves a mesh can be raised. One machine on a public segment with a way
+# out to the internet, the host placed, and nothing else — the installer carries the control
+# plane's image and the substrate's own images are pulled over the uplink, exactly as they are on
+# a bare machine.
+#
+# The address matters: the substrate template names the broker at 192.0.2.10, and a token carries
+# that address verbatim as the endpoint an enrolling node dials. With one machine, that machine
+# must BE it, or the mesh would hand out an endpoint nothing answers on.
+scenario: genesis-single
+
+segments:
+  hosting:
+    kind: public
+    cidr: [192.0.2.0/24, "2001:db8:a::/48"]
+
+machines:
+  anchor:
+    at: { segment: hosting, address: [192.0.2.10, "2001:db8:a::10"] }
+    # The way out. Without it the machine is sealed in, and the installer stops at its first pull:
+    # the store, the broker and the registry all come from the internet, exactly as they do on a
+    # bare machine. A scenario that needs no images can omit this; genesis cannot.
+    egress: true
+    inbound: allow
+    # Enough for the substrate (store, broker), the registry, and two control planes during the
+    # pivot. Smaller than the four-node bed's anchor, which also carries a whole service set.
+    memory: 8GiB
+    cpus: 4
+    disk: 40GiB
+
+# The host, and a container runtime for it to drive.
+#
+# The runtime is not a mesh tier — it is a prerequisite of the machine, and the installer's first
+# step refuses to go on without one. Placing it here is the lab preparing a machine, not the lab
+# describing an installation. Everything above tier 0 — the substrate, the registry, the control
+# plane — is the installer's, and the lab places none of it. That is the whole point of this bed:
+# if the lab placed the substrate, it would be describing installing all over again.
+place:
+  all: [host, runtime]