[FEATURE] ate-setup bootstrap command and keys-only bootstrap Job #3676

Implements the install bootstrap contract (#3175). Adds an in-cluster ate-setup bootstrap Job that creates missing key pools and runs the database safety guards, so the kustomize, Helm and provider install paths don't need ate-setup on the operator's machine.

Tracks "Add a keys-only bootstrap Job" in the Publish the install as kustomize bases workstream of the Extensible Install Roadmap.

Current state (0b635b80): ate-setup creates the key pools imperatively from the operator's machine (cmd/ate-setup/internal/steps/create.go). There is no bootstrap subcommand.

Required changes

• ate-setup bootstrap:
  • creates the missing key-pool Secrets and derived certificates listed in [FEATURE] Install Bootstrap #3175;
  • refreshes the published JWT key set when it is stale;
  • creates k8s-credential-provider-namespace-policy if it is absent;
  • refuses forbidden database switches;
  • never rotates or replaces existing keys.
• Arguments: --database-mode=bundled|external and --namespace. Exit codes: 0 success, 1 unexpected error, 2 guard refused.
• Manifests for release/bootstrap/:
  • the namespaces;
  • a ServiceAccount;
  • RBAC: get and create on Secrets and ConfigMaps in both namespaces, update on actor-id-jwt-pool only, get on ate-api-server-secret-envvars, no pods/exec;
  • a Job named ate-bootstrap-<version> with ttlSecondsAfterFinished.
• Publish the ate-setup image, or a dedicated bootstrap image. It is not in the released image set today.
• ate-setup deploy runs the same code path, so both install paths create keys the same way.
• Resolve the open points on [FEATURE] Install Bootstrap #3175 first:
  • whether disabled mode still runs the read-only guards and the release-transition checks (Add pre-upgrade safety checks and reusable policy evaluation #2941, ate-setup: validate release transitions #3493);
  • how namespaces are created under Helm hooks without before-hook-creation deleting them.

Dependencies: #3175 contract agreed; release coordinates for the image (#3664).

Enforcement

• Running bootstrap twice changes nothing.
• A cluster with pre-created objects starts with bootstrap disabled.
• The guard test exits 2 on a forbidden switch.
• ate-setup delete followed by deploy does not regenerate existing CAs (ate-setup delete ate-system + deploy ate-system regenerates the pod-identity CA and breaks mTLS for existing client pods until their leaf certs rotate (~23h), and leaks cluster-scoped resources on --kind / --setup-csi #3273).

Parent Issue: #3169