swarmctl: add bao init and bao grant-bootstrap

init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.

Cargo.toml

@@ -174,6 +174,8 @@ tracing-journald = "0.3.2"
 rustix = { version = "1.1.4", default-features = false, features = [
   "std",
   "fs",
+  # `swarmctl bao grant-bootstrap` turns terminal echo off for the root token.
+  "termios",
 ] }
 reqwest = { version = "0.13", default-features = false, features = [
   # RFC 7662 introspection posts an urlencoded body; without this,
@@ -287,6 +289,9 @@ utoipa-axum = "0.2"
 # re-issue it at half its life. `der` and `spki` are already in the tree
 # through `pkcs8`.
 x509-cert = { version = "0.2", default-features = false, features = ["pem"] }
+# Wipes the root token and the bootstrap grant token from memory once
+# `swarmctl bao` has handed them on. Already in the lock through the TLS stack.
+zeroize = "1"
 # Test doubles with expectations (canned replies, call counts, argument
 # matchers). Dev-dependency only, and used behind `#[cfg(test)]`, so release
 # builds never compile it. See "Testing seams and test doubles" in