The runtime every module stands on is built from its own repository

It copied in a compiled directory that is not in source control and resolved
the toolkit to a sibling checkout, so only a workstation with two repositories
side by side could produce it — and its fingerprint was then typed into every
module by hand. Nothing could rebuild it, so nothing could check it, and the
rule that catches a base moving had no version on the far end of its edge.

The recipe now also says what the image in service actually is. It claimed
Alpine and has been serving Debian for as long as nobody could rebuild it.

module.json

@@ -0,0 +1,11 @@
+{
+  "module": "mesh-tools",
+  "version": "1",
+  "slug": "tools",
+  "build": {
+    "artifacts": [
+      { "name": "runtime", "kind": "image", "from": "Dockerfile" }
+    ]
+  },
+  "resources": []
+}