fix(azure): bootstrap Kiingo agent endpoint

[RossHartmann]

Summary

• fail closed before the production ACP listener starts unless Kiingo API registers the exact community/agent endpoint
• bind bootstrap to the rendered Kiingo organization, owner, canonical relay, and local signing public key
• keep the bridge bearer secret off process arguments and remove the private response file on every exit
• document restart-stable, no-credential endpoint ownership semantics

Validation

• production manifest parsed as three YAML documents
• extracted bootstrap script passed shell syntax validation
• production workflow render simulation resolved the new organization and owner placeholders
• Prettier and git diff checks passed

Deployment ordering

Deploy only after Kiingo/kiingo#8710 has applied migration 0591 and released the matching API route. The pod remains stopped if bootstrap does not return an explicit registered response.