Split the AMI bake out of remote bootstrap

[outofcoffee]

Split the AMI bake out of spinloop remote bootstrap into its own spinloop remote bake command (issue #139).

Summary

• New spinloop remote bake [runner...] command: starts an AMI bake for each named runner (default: both llamacpp and vllm) and waits until the AMI(s) are available, so it returns at the point spinloop remote deploy can go; --no-wait returns once the bakes are queued, for running them in parallel with a weight seed. It reuses bootstrap's version-matched source download, package-manager preflight, and --ref/--dir/--region/--package-manager flags
• BREAKING: spinloop remote bootstrap no longer starts any bake — the --runners, --wait, and --force-bake flags are removed, and the sequence is just install → cdk bootstrap → deploy:image → deploy
• Bootstrap's success output signposts spinloop remote bake as the next step, ahead of spinloop remote deploy
• The bare-group usage (spinloop remote / fleet / remote seed) was a hand-rolled subcommand list that had already drifted (it did not name bake); the group parents now show the help cobra generates from the tree, and a mistyped subcommand is cobra's own unknown-command error
• Spec deltas for endpoint-provisioning (new bake requirement, bootstrap requirements trimmed of the bake) and remote-endpoint (command group gains bake)

Implementation details

• Bake is a first-class command rather than a printed pnpm bake recipe: bootstrap's sources sit in a ref-keyed cache under the user config dir, pruned after success, so there is no stable path to signpost
• Wait is the default (60 s poll, 60-minute bound) because a cold first deploy otherwise finds no AMI to launch from; the bound means a failed bake is reported rather than hung on. --no-wait prints how to check on the builds
• Bake deploys nothing, but fails early naming spinloop remote bootstrap when the control plane is absent — the pnpm bake script's own error tells the user to run pnpm deploy:image by hand
• No consent gate on bake (an explicit, narrow user action costing a 20–40 min builder instance); bootstrap keeps its plan-and-confirm
• The dead cdk.json context.runners write goes with --runners: the CDK reads no such key, and the image stack always creates both runners' pipelines
• The shared machinery (step seams, source resolution, waitForBake, the package-manager preflight) is renamed and factored into remote_sources.go so both commands use it
• The group-parent help sentinel is pflag's ErrHelp, not the stdlib one: cobra's ExecuteC checks pflag's, and the stdlib twin surfaces as a bare "flag: help requested" error