fix(infra): hard-disable self-serve bootstrap; make billed hosts recoverable

- Remove the broken NEHEMIAH_ALLOW_UNMANAGED_BOOTSTRAP override: setup.sh and
  setup-local.sh invoked the remote bootstrap without staging/forwarding the
  signed-release inputs (SSH/Lima don't inherit the operator env), so the override
  produced an unusable host. Both flows now hard-fail with a pointer to the managed
  provision path.
- provision.sh persists the requested hostname (a durable correlation value) and
  the validated server id BEFORE polling, and on a malformed 201 body it aborts
  with actionable recovery guidance instead of a bare parse error.
- teardown.sh gains a hostname-based recovery path: when no id is known it queries
  Latitude and deletes the single validated match, never inferring an id from a
  malformed body.