Trim the bootstrap layer back to just-enough-to-bootstrap

## Summary

Audit the bootstrap layer and move everything that does not genuinely need
to be there into the alunduil layer, so bootstrap stays scoped to standing
up the automated infrastructure and nothing more.

## Motivation

Bootstrap's remit is the minimum needed to make CI apply work: isolated
state, WIF, deployer identities, and the credentials that can only live in
IAM-isolated state. It has since accreted resources that sit there for
convenience or chicken-and-egg reasons rather than necessity — the Grafana
provisioning SA/token, the Git Sync App key, and now the `grafana-gcp-reader`
SA/key from #88. Each addition stretches the "just enough to bootstrap"
intent a little further.

## Scope

- Inventory every bootstrap resource and classify: (a) must be here
(isolated state for a secret, or an identity the automated layer depends
on to run at all), vs (b) here for convenience and movable to alunduil.
- For the movable set, decide whether the blocker is real (e.g. a secret
that would otherwise land in bucket-readable alunduil state) or incidental,
and relocate what can move.
- Capture the retained-in-bootstrap rule as a short criterion in the repo
guide so future additions get placed deliberately.

## Acceptance criteria

- [ ] A documented classification of bootstrap resources (keep vs. movable).
- [ ] Movable resources relocated to the alunduil layer without regressing
the secret-out-of-readable-state posture.
- [ ] A stated criterion for what belongs in bootstrap.

## Additional context

Follow-up to #88, which surfaced the tension by adding the
`grafana-gcp-reader` SA/key to bootstrap to keep its key out of the
bucket-readable alunduil state. Related: #80 / #224 (bootstrap state
isolation).