Function run_bootstrap 

pub fn run_bootstrap(
    store: &LocalFsStore,
    registry: &EnvPackRegistry,
    env_id: &EnvId,
    admin: &ZeroizedAdmin,
    creds_override: Option<&dyn DeployerCredentials>,
    secret_sink: &BoundSecretSink<'_>,
) -> Result<Credentials, RunBootstrapError>

Drive a bootstrap flow against the env’s bound deployer env-pack, inside a single transactional scope.

The entire flow — load env, assert credentials_ref absent, invoke the handler’s bootstrap path, write the rules pack, persist the new credentials_ref — runs while holding the env’s exclusive flock. This prevents two concurrent invocations from both passing the absence check, consuming admin credentials, and racing on the final write.

Trade-off: Bootstrap may be long-running (handler calls out to a cloud provider), so the env flock is held for the full duration of the call. This is acceptable because (a) bootstrap is a one-shot admin operation, not a hot path, and (b) other verbs that need the flock (requirements, rotate, traffic mutations) will simply block until bootstrap completes, which is the correct serialization.