Consolidate the M4 bootstrap script to a single home (retire the ronin dead copy)

[rcurranmoz]

Problem

The M4 bootstrap script exists in two+ places, which is a standing #1260-style divergence risk (editing/deploying the wrong copy strands an EACS'd host):

• LIVE: relops-bootstrap/pkg/payload/usr/local/sbin/m4-bootstrap.sh — built + signed via pkg/build.sh, shipped to the M4 group as a managed pkg. This is what actually runs.
• DEAD copy: ronin_puppet/provisioners/macos/simplemdm_bootstrap_sip_safari.sh — kept in sync by hand; the SimpleMDM script-job path (script id 14716) is retired in favor of the pkg.

Divergence has already caused real pain:

• #1260 footgun — pasting the ronin (waits-only) copy into SimpleMDM 14716 dropped the fetch/BST blocks → m4-81 hung at Waiting for /var/root/vault.yaml.
• 2026-07-13 — the hard-coded-admin-password removal was first applied to the dead ronin shell script (and its own #1262) before we realized the pkg is the live artifact; the real fix had to be re-done in pkg/ (pkg/m4-bootstrap: drop hard-coded admin password (wait for SecureToken) #33). Two copies = wasted work + a chance to ship the wrong one.

Goal

One canonical source of truth for the bootstrap — the relops-bootstrap pkg — so no one can edit/deploy a stale or wrong copy.

Proposed

• Declare relops-bootstrap/pkg/payload/usr/local/sbin/m4-bootstrap.sh the single source; pkg build/sign/deploy is the only path.
• Remove ronin_puppet/provisioners/macos/simplemdm_bootstrap_sip_safari.sh (or replace it with a one-line README pointer to the relops-bootstrap pkg) after confirming nothing in ronin references/deploys it (it's provisioners/, bootstrap-time only; the pkg superseded the script-job path).
• Confirm the SimpleMDM "Prod - Bootstrap M4" app = the signed pkg (not a pasted script body).
• Update handoffs/docs that point at the ronin copy.

Context

Password-free bootstrap (relops-bootstrap #33 + ronin #1262) merged 2026-07-13 and proven E2E via the m4-80 reprovision. The pkg is the live path; this issue removes the dead copy so the two can't drift again. See memory/handoffs on the #1260 divergence.