swarmctl: add bao init and bao grant-bootstrap

init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.

swarmctl/src/setup.rs

@@ -111,7 +111,7 @@ pub(crate) struct Observed {
 const STEPS: [(&str, &str, bool); 10] = [
     (
         "secret store initialised",
-        "setup.md § 1: `sudo bao operator init`, on the host running swarm-bao",
+        "setup.md § 1: `swarmctl bao init`",
         false,
     ),
     (
@@ -121,7 +121,7 @@ const STEPS: [(&str, &str, bool); 10] = [
     ),
     (
         "granter bootstrapped",
-        "setup.md § 1: the bao-bootstrap block, then `systemctl restart swarm-bao-granter-role`",
+        "setup.md § 1: `swarmctl bao grant-bootstrap`, on the host running swarm-bao",
         false,
     ),
     (