Onboard the Registry Casework release image before the first 0.30.0 candidate

### What is missing

Registry Casework joins the release set at 0.30.0 with `casework`, `caseworkctl`, and `mint` in `casework-install.sh` and the `ghcr.io/registrystack/casework` image. The docs on the `docs/casework-rewrite` branch already cite `ghcr.io/registrystack/casework:v0.30.0`. The out-of-band onboarding steps in `release/OPERATIONS.md` ("Onboard a new release image", steps 3 to 6) are not done, and nothing fails early on them: the first real candidate fails closed instead, the same shape as the BReg onboarding at v0.26.0.

Verified on 2026-09-11:

- `gh api /orgs/registrystack/packages/container/casework` returns 404, and so does `casework-candidate`. Neither GHCR package identity exists.
- `casework-candidate` is absent from `CANDIDATE_PACKAGES` in `release/scripts/cleanup-release-candidates.py`. It must stay absent until the private package exists, because listing an absent package fails the whole daily cleanup run closed.
- `release/security/casework-advisory-baseline.json` does not exist, and `release/scripts/test_check_advisory_baselines.py` pins only the relay, breg, discovery, evidence, and mint baselines.

### Ask

In the order the operations guide gives, outside the release clock:

1. Run the classic-PAT oras bootstrap for `casework` (public) and `casework-candidate` (private), and grant both `registrystack/registry-stack` Actions access with Write.
2. Add `casework-candidate` to `CANDIDATE_PACKAGES` with its matching test, as soon as the private package exists. Keep `casework` in `PUBLIC_PACKAGES`.
3. Run one named baseline-bootstrap candidate, which is expected to stop at the advisory-baseline check.
4. Author and review `release/security/casework-advisory-baseline.json` from that exact private image, and extend the baseline test pins with it. Do not copy another product's baseline.

### Why a ticket

These steps need a real candidate image and a human sign-off on the baseline, so they cannot ride in the documentation and installer PR that introduces the release assets.

Beginne mit den Schritten 3–6 in release/OPERATIONS.md, untersuche anschließend release/scripts/cleanup-release-candidates.py und release/scripts/test_check_advisory_baselines.py. Bootstrappe die öffentlichen und privaten casework-Pakete, führe einen benannten baseline-bootstrap-Kandidaten aus und verwende genau dieses private Image für die Advisory-Baseline. Erledigt bedeutet, dass der Paketzugriff funktioniert, die Tests zur Bereinigung von Kandidaten und zur Baseline erfolgreich sind und release/security/casework-advisory-baseline.json geprüft und festgeschrieben ist.

Vom Indexierungsmodell aus dem Issue-Text verfasst.