F-host 2, ENG-5: the bootstrap's one-off push credential goes to distribution's account, mode 0600, only once the node-engine made that account and its state directory, so the holder's program can read it (review of issue 1966)

The owner is the account the manifest names for the directory that holds the file; the bootstrap no longer makes that
directory itself, and a run that reaches it first is refused naming what it waits on.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

internal/bootstrap/bootstrap.go

@@ -159,9 +159,8 @@ type Options struct {
 
 	// PushCredentialFile is where the bootstrap writes its one-off push credential for the store's holder to find, the
 	// holder's state file `bootstrap-push` on the node that holds it (design 51 *The move*, issue 1966 ENG-5); empty writes
-	// none. PushCredentialOwner is the user id and group id the file is given when the holder's account is known.
-	PushCredentialFile  string
-	PushCredentialOwner *[2]int
+	// none. The file goes to the account that owns that directory in the holder's manifest, once the node-engine made both.
+	PushCredentialFile string
 
 	// Host is the `mesh-host` binary on this machine — the program that enrols and then holds the
 	// machine to what the mesh says. The installer runs it; it does not contain it.
@@ -826,7 +825,7 @@ func RegistryAndPublish(ctx context.Context, o Options, d Deps, sys system.Syste
 	// The one-off credential the holders' first images are pushed to the store's front with, written for its holder to find
 	// and forgotten when this run ends; the holder discards the file once it answers its first publish (ENG-5).
 	if o.PushCredentialFile != "" {
-		cred, err := MintPushCredential(o.PushCredentialFile, o.PushCredentialOwner)
+		cred, err := WritePushCredential(o.Catalogue, o.PushCredentialFile)
 		if err != nil {
 			return Published{}, failed(StepRegistry, err)
 		}