CAT-D4b: the program, as distribution's account, discards the bootstrap's credential when the tools close its window

The tools bundle runs in the tool runner's account and cannot remove a file in
distribution's 0700 state directory, so its first answered publish closes the
window bootstrap-push in the state windows and the program removes the file
(design 51 On a fresh mesh).

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/internal/holder/window.go

@@ -16,6 +16,10 @@ import (
 const (
 	OldNameWindow      = "old-name"
 	DirectWritesWindow = "direct-writes"
+	// BootstrapWindow is the bootstrap's one-off credential (BootstrapFile): open while the file is there. The tools
+	// bundle closes it at its first answered publish; the program, which runs as distribution's account and alone may
+	// remove the file in distribution's state directory, removes it on that close.
+	BootstrapWindow = "bootstrap-push"
 	// WindowFindingAfter is how long a node holds a window open before it is distribution's finding naming the node.
 	WindowFindingAfter = 7 * 24 * time.Hour
 	// The events a window's close says on distribution's own family distribution.events (7 days, 16 MiB, drop