fix(bootstrap): auto-complete bootstrap when workspace self-trusts its signing key (#738)

[dollspace-gay]

Summary

• Fixes the post-#737/GH#585 deadlock where crosslink init + crosslink sync leaves meta/bootstrap.json at status: "pending" forever — trust pending shows nothing (the workspace key was already auto-trusted), and signing_enforcement: "enforced" bails every sync with guidance that's impossible to follow.
• Treats workspace self-trust as the moral equivalent of trust approve on the operator's own key: when register_active_key_as_trusted actually adds a new entry while bootstrap is pending, flips bootstrap to complete and stages meta/bootstrap.json into the same atomic unsigned commit.
• Adds "trust: register signing key" to BOOTSTRAP_MESSAGE_PREFIXES so the unsigned self-trust commit is correctly filtered by signing audit going forward.
• sync_cmd snapshots bootstrap state before/after configure_signing and prints Bootstrap complete — signing enforcement is now active. for UX parity with trust approve.

Repro before the fix

$ crosslink init
... ✓ Initializing agent identity ... ✓
$ crosslink sync
Published agent key to hub (deferred from agent init).
Locks synced (commit ... is an unsigned bootstrap commit).
Error: Hub bootstrap incomplete — signing enforcement cannot proceed.
$ crosslink trust pending
No pending keys. All published keys are approved.   ← deadlock

Test plan

• cargo build --lib clean
• cargo fmt --check clean
• cargo clippy --lib clean
• cargo test --lib sync:: — 145/145 pass (includes two new GH#738 tests + GH#585 tests covering the same path)
• Manual: in a fresh repo, crosslink init → crosslink sync no longer leaves bootstrap pending; a second crosslink sync succeeds with Signing audit: all N recent commit(s) are signed.

🤖 Generated with Claude Code