fix(infra): descope self-serve local bootstrap; mark bootstrap.sh managed-only

bootstrap.sh installs Firecracker/jailer/kernel only from signed managed-release
artifacts, so the self-serve setup.sh / setup-local.sh flows that invoked it would
exit cryptically on the first missing signed-release var. They now fail fast with a
clear message pointing at the managed provisioning path, gated behind an explicit
NEHEMIAH_ALLOW_UNMANAGED_BOOTSTRAP=1 opt-in for operators who have primed the target.