feat: add static-credential quickstart

[neebs12]

Summary

• make a Classic PAT and dedicated static IAM user the default Quickstart
• grant the Quickstart user bootstrap, image build, and runner lifecycle permissions
• rotate AWS credentials directly into GitHub Actions secrets without writing the secret key to disk
• keep OIDC and GitHub App credentials as a separate advanced setup
• add mocked credential creation/rotation tests and static-credential workflow example

Validation

• npm run check (58 Action tests, Quickstart credential tests, 17 supervisor tests)
• shellcheck scripts/*.sh test/scripts/*.sh
• actionlint 1.7.12 across workflows and examples
• no infrastructure-framework files or references