docs: sync production-bootstrap.md with the current master bootstrap

[heifner]

Summary

docs/production-bootstrap.md had drifted from what the bootstrap actually does. Every value and action in the doc was re-verified against ClusterBuildDefaults + Constants.ts on master (and against wire-sysio master for the contract-side claims — ROA tier math, giftram, uwrit/dclaim defaults, the genesis intrinsic whitelist; the dev-key literals were re-derived from their seeds via sdk-core). This PR updates the doc to match, and renumbers the stages to follow ClusterBuildDefaults.compose's actual execution order so the old "idealized grouping vs. real order" caveat mostly disappears.

Value fixes

• epoch_duration_sec 360 → 90; epoch_retention_envelope_log_count 128 → 10
• sysio.uwrit::setconfig rewritten to the current 4-field ABI: fee_bps:30 (contract default 10), collateral_lock_duration_ms:600000, min_fromwire_amount:100000000 (0.1 WIRE; contract default 5 WIRE), fromwire_revert_fee_bps:10 — the legacy fee_split_* fields are gone from the ABI
• Stablecoin token rows (USDC/USDT/USDCSOL/USDTSOL) register precision: 6; reserves gained source_token_precision (6 stable / 9 otherwise) and the stablecoin chain-leg seed is 10,000,000 — the same 10-token notional in the 6-dec native frame
• Port section rewritten: defaults live in 10500–11999 above agave's reserved 8000–10000 band (bios 10788/10776, kiod 10890, anvil 10545, solana RPC 10899, …); producer/operator nodeop ports are dynamically claimed pairs — no fixed 8888/9876 bases
• Underwriter daemons load five plugins (+external_debugging_plugin, +cron_plugin); batch operators get a 100-SOL fee-payer airdrop

Actions removed (no longer performed by the bootstrap)

• sysio::init
• The authex-owner grant, the sysio-active rewrite, and the three cross-contract @sysio.code active delegations (opreg/roa/authex) — the nine OPP owner grants are now the only authority rewrites, and the doc says so explicitly

Mechanism/description fixes

• Producers are keyed by their hosting node's generated K1 and operators by their own unique generated K1 (imported into kiod); DEV_K1 remains only the genesis signer, sysio's active key, and wireno's key
• No sysio.roa::addpolicy during bootstrap — reframed as post-bootstrap flow/user provisioning issued as wireno
• PREACTIVATE_FEATURE is effectively active from genesis (preactivate_feature is in wire-sysio's genesis intrinsic whitelist) — no producer-API scheduling step exists
• giftram rejects non-finite targets (it no longer skips them); nodeownreg soft-fail + verify noted
• Source-of-truth pointer now names orchestration/ClusterBuildDefaults.ts + src/Constants.ts

Flagged for follow-up (not changed here)

Stage 12 now carries the target design note: operator accounts should be created/sponsored by a node owner rather than by sysio directly — the doc documents master's current behavior, and the harness/flow update lands separately.

[jglanz]

This doc has a key in it still, can you replace it with pseudo code using the name that is hashed to generate the key - approving but please make the edit first

[jglanz]

As stated on #37 this is massive change, a full discussion is required

[heifner]

Done in 0aa7662 — the literal dev key strings are gone; the Keys table now derives them as pseudo-code from the hashed seed names (DEV_K1 = K1.regenerate(SHA256("nathan")), DEV_BLS = BLS.regenerate(SHA256("wire"))), with the table rows referencing DEV_K1.publicKey / .privateKey / DEV_BLS.publicKey / .proofOfPossession spellings only. No key material remains in the doc (grep-verified). Also merged into #37 so the stacked branch stays in sync.