Bootstrap enrollment for Central and Pilot

Provisioning now hands benches single-use bootstrap tokens instead of durable credentials; benches mint their own via `bench enroll`.