Onboard the Registry Casework release image before the first 0.30.0 candidate

### What is missing

Registry Casework joins the release set at 0.30.0 with `casework`, `caseworkctl`, and `mint` in `casework-install.sh` and the `ghcr.io/registrystack/casework` image. The docs on the `docs/casework-rewrite` branch already cite `ghcr.io/registrystack/casework:v0.30.0`. The out-of-band onboarding steps in `release/OPERATIONS.md` ("Onboard a new release image", steps 3 to 6) are not done, and nothing fails early on them: the first real candidate fails closed instead, the same shape as the BReg onboarding at v0.26.0.

Verified on 2026-09-11:

- `gh api /orgs/registrystack/packages/container/casework` returns 404, and so does `casework-candidate`. Neither GHCR package identity exists.
- `casework-candidate` is absent from `CANDIDATE_PACKAGES` in `release/scripts/cleanup-release-candidates.py`. It must stay absent until the private package exists, because listing an absent package fails the whole daily cleanup run closed.
- `release/security/casework-advisory-baseline.json` does not exist, and `release/scripts/test_check_advisory_baselines.py` pins only the relay, breg, discovery, evidence, and mint baselines.

### Ask

In the order the operations guide gives, outside the release clock:

1. Run the classic-PAT oras bootstrap for `casework` (public) and `casework-candidate` (private), and grant both `registrystack/registry-stack` Actions access with Write.
2. Add `casework-candidate` to `CANDIDATE_PACKAGES` with its matching test, as soon as the private package exists. Keep `casework` in `PUBLIC_PACKAGES`.
3. Run one named baseline-bootstrap candidate, which is expected to stop at the advisory-baseline check.
4. Author and review `release/security/casework-advisory-baseline.json` from that exact private image, and extend the baseline test pins with it. Do not copy another product's baseline.

### Why a ticket

These steps need a real candidate image and a human sign-off on the baseline, so they cannot ride in the documentation and installer PR that introduces the release assets.

Start with steps 3–6 in release/OPERATIONS.md, then inspect release/scripts/cleanup-release-candidates.py and release/scripts/test_check_advisory_baselines.py. Bootstrap the public and private casework packages, run one named baseline-bootstrap candidate, and use that exact private image for the advisory baseline. Done means package access works, candidate cleanup and baseline tests pass, and release/security/casework-advisory-baseline.json is reviewed and pinned.

Written by the indexing model from the issue text.