Stop printing credentials to stdout

The omnibus bootstrap echoed the minted admin PAT as its last line and status dumped the state file raw, so a root PAT reached the transcript of whatever was driving the tooling. Both surfaced during a real run against a customer reproduction.

The echoed PAT had no consumer. install_omnibus displays that stdout through | tail -10 and never captures it, the seeders read /var/lib/simulation/root-pat.json directly on the VM, and simulation.sh mints its own separate token in mint_root_pat. So the line is removed rather than filtered, which is the difference between making the leak impossible and making it conditional on every future caller remembering.

status masks root_pat and gitlab_root_password and names the state file instead. Existence is what a status command owes the reader; the value is a deliberate second step. It uses with_entries rather than an |= update, because updating through a missing path creates it and would invent root_pat: null on a base that never mints one.

The bootstrap's root-password line prints the value only when it is the documented default, where it carries no information, and otherwise names the variable rather than repeating the operator's own secret into a log.

Siblings audited for the same shape: bootstrap-gitlab.sh (caproni) and bootstrap-gitlab-dev.sh do not print tokens and both run detached with stdout redirected to a log on the VM. cmd_status was the only place the state file was dumped whole.

just ci passes.