ADR-104 Part A: converge the three install paths on one provisioning contract

[aaronsb]

Implements Part A of ADR-104.

Converge the three install paths (install.sh pull-GHCR, operator.sh init build-local, appliance first-boot) onto one provisioning contract, keeping only their irreducible differences (file acquisition / image source / interactivity).

• Single secret generator: install.sh sources operator/lib/init-secrets.sh; delete install.sh's generate_secrets() (the duplicate that caused the Infra config asserts: prod port exposure, nginx security headers/HSTS, weak .env.example secrets + startup refusal #502 drift — fix landed in one path only).
• Factor the shared contract: ensure infra secrets → bring up stack → surface claim token.
• Keep install.sh-only concerns separate (SSL/Let's Encrypt, macvlan, host shim).

Depends on the claim protocol (Part B) for the "surface claim token" step. Pure-consolidation steps (single generator) can land first. Refs ADR-104, #502.