feat: automate firmware reference value collection with full pod lifecycle

Replace direct Vault push script with full lifecycle automation following
the established Pattern A (local file → values-secret.yaml → Vault):

- Rewrite collect-firmware-refvals.sh to manage complete pod lifecycle:
  launch kata pod, install veritas, collect measurements, save locally,
  cleanup pod via trap handlers
- Change output format from multi-key Vault secret to single JSON blob
  saved to ~/.coco-pattern/firmware-reference-values.json
- Add --merge option to support multi-OCP-version reference values
- Add --namespace, --output, --runtime-class, --pod-image options
- Update values-secret.yaml.template to reference local JSON file
- Update Makefile targets: collect-firmware-refvals and
  collect-firmware-refvals-merge
- Update gen-secrets.sh bare metal messaging
- Rewrite docs/firmware-reference-values.md for automated workflow

This aligns firmware reference value management with pcrStash and KBS
keys patterns, eliminating manual Vault interaction.

Requires trustee-chart PR #30 (single JSON blob consumption).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: butler54

Makefile

@@ -5,11 +5,10 @@
 include Makefile-common
 
 ##@ Firmware Reference Values
-.PHONY: push-firmware-refvals
-push-firmware-refvals: ## Push firmware reference values to Vault (REFVALS_FILE=<path>)
-	@if [ -z "$(REFVALS_FILE)" ]; then \
-		echo "Error: REFVALS_FILE not specified" >&2; \
-		echo "Usage: make push-firmware-refvals REFVALS_FILE=./refvals.json" >&2; \
-		exit 1; \
-	fi
-	@scripts/collect-firmware-refvals.sh $(REFVALS_FILE)
+.PHONY: collect-firmware-refvals
+collect-firmware-refvals: ## Collect firmware reference values from bare metal cluster
+	@scripts/collect-firmware-refvals.sh
+
+.PHONY: collect-firmware-refvals-merge
+collect-firmware-refvals-merge: ## Collect and merge with existing firmware refvals
+	@scripts/collect-firmware-refvals.sh --merge