F-host 2, ENG-5: on a fresh mesh the bootstrap pushes the holders' own images to the store on its loopback with no credential, and names them under the seat's reach (lead's design limit, review of issue 1966)

The store's front is distribution's program, a bundle the mesh builds, so nothing serves it before the builder: the
bootstrap's /v2/ wait and its pushes now go to the loopback port the store's manifest publishes, as the publish contract
allows on the store's own node. The one-off credential and its file go: the runtime could not carry it on a push, and no
push needs it. The tags list is asked for the repository being published, not always the control plane's.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

cmd/mesh-bootstrap/main.go

@@ -188,9 +188,7 @@ func parseArgs(args []string) (string, bootstrap.Options, bool, error) {
 		Out:      defaultOut,
 		State:    store.DefaultPath,
 		Registry: defaultRegistry,
-		// Where the store's holder reads the one-off credential the holders' first images are pushed with (design 51, ENG-5).
-		PushCredentialFile: "/var/lib/mesh/registry/bootstrap-push",
-		Host:               defaultHost,
+		Host:     defaultHost,
 		// The machine's own name, because that is what a person already calls it and an installer
 		// inventing a different one would leave the mesh naming a machine nobody recognises. It is
 		// read here rather than inside the bootstrap so that --node overrides a fact rather than a