Infralink v0.6.24

Infralink v0.6.24

Host bootstrap now declares the GHCR username and token as typed BWS secret
references. The bootstrap preflight requires those references to belong to the
target host's declared bws_projects list and validates that the supplied
machine token can read them before any remote mutation.

This release supplies the typed contract consumed by the paired baseline
executor change in infra-management. The executor resolves the declared
references only transiently to authenticate Docker before the first private
controller image pull.