Add headless/non-interactive mode to bootstrap.sh and bootstrap.ps1 for CD

## Summary

Prerequisite for #173 (CD: GitHub Action to provision a sandbox).

`scripts/bootstrap.sh` and `scripts/bootstrap.ps1` generate `terraform.tfvars`, but only in an
**interactive** way that can't run in CD:

- They use interactive prompts (`read -e` / `Read-Host`) with defaults — they cannot complete unattended.
- They derive `user_object_id` by **JWT-decoding the Azure CLI signed-in user's access token** (via
PyJWT). Under a CD managed identity / OIDC, the signed-in identity is the *runner*, not the human
admin, so this yields the wrong object id.
- They depend on `PyJWT` (bootstrap.sh) just to decode the signed-in user's `oid`.
- They **always comment out** the `enable_module_*` toggles, so module enablement must be edited
separately — CD needs to set these from inputs.

## Goal

Add a **headless / non-interactive mode** to both scripts (kept equivalent) so the same scripts are
the single source of truth for `terraform.tfvars` generation in both manual and CD flows.

## Acceptance criteria

- [ ] A non-interactive switch (e.g. `--non-interactive` / `-NonInteractive`) that fails fast on any
missing required value instead of prompting.
- [ ] All values accepted via parameters/flags or environment variables (arm_client_id,
aad_tenant_id, user_name/UPN, subscription_id, location, tags, and **module toggles**).
- [ ] **`user_object_id` resolved from a provided UPN via Microsoft Graph** (`az ad user show --id
` / `Get-AzADUser`) rather than JWT-decoding the signed-in user — so it works under a CD
managed identity where the signed-in identity is not the admin. Direct `user_object_id` input
should also be accepted to skip the lookup. Removes the hard PyJWT dependency in that path.
- [ ] Ability to set `enable_module_*` toggles (uncommented) from inputs.
- [ ] Existing **interactive** behavior is preserved unchanged as the default.
- [ ] `user_name` UPN-format validation still enforced; no blank `user_name` written.
- [ ] README and copilot-instructions updated to document the headless mode.

## Notes

- Coordinate with #496 (secretless auth): headless mode must work when authenticated via managed
identity (no `TF_VAR_arm_client_secret`), so the secret check should be conditional on auth mode.

Start by reading scripts/bootstrap.sh and scripts/bootstrap.ps1, comparing their current prompts, authentication checks, and terraform.tfvars generation. Run the existing scripts to understand interactive behavior, then review README and copilot-instructions; done means both scripts support documented unattended inputs and module toggles while preserving the default interactive flow and validating the required identity values.

Written by the indexing model from the issue text.