Expand description
First-boot bootstrap manifest support.
The manifest is applied only before system.bootstrap.completed is
persisted by the server bootstrap path. It is intentionally a thin
translation layer over existing public surfaces: AuthStore for users
and IAM policies, ConfigRegistry for managed guardrails, and
red_config rows for config values.