fix: comment out airgap-only secrets by default in values-secret template

[butler54]

Problem

values-secret.yaml.template unconditionally enables airgap-only secrets
(registryCaCert, bootstrap_secrets/mirror-registry-helm-oci), so
connected deployments (Azure, connected bare metal) hit make load-secrets
failures because the referenced local files
(~/.coco-pattern/mirror-registry-ca-cert.pem,
~/.coco-pattern/mirror-registry-password) only exist for disconnected-mirror
deployments.

Separately, pcrStash (Azure) and firmwareReferenceValues (bare metal) are
both enabled unconditionally so the same template works on either topology,
but nothing ensured the unused platform's local reference-value file
existed — so make load-secrets could fail on whichever platform you aren't
actively deploying to (this exact issue was previously worked around
manually with an empty {} placeholder during earlier testing).

Changes

• Comment out registryCaCert and bootstrap_secrets in
  values-secret.yaml.template by default, wrapped in
  AIRGAP-MIRROR-SECRETS-START/-END markers.
• Add scripts/enable-airgap-secrets.sh + make enable-airgap-secrets to
  uncomment both blocks together for airgap deployments in one step; wired
  into airgap/DEPLOY-RUNBOOK.md step D-3 so the automated runbook keeps
  working unattended.
• Also comment out tdxCollateral by default for consistency — it was
  labeled # Optional in its section header but was active unconditionally,
  the same class of bug (bare-metal-TDX-only, would fail on Azure / AMD
  SEV-SNP bare metal).
• Keep pcrStash and firmwareReferenceValues active by default (no
  per-topology template editing required). To prevent make load-secrets
  from failing on whichever platform's file is missing:
  • gen-secrets.sh now pre-touches both ~/.coco-pattern/measurements.json
    and ~/.coco-pattern/firmware-reference-values.json with an empty {}
    placeholder if they don't already exist.
  • collect-firmware-refvals.sh also touches the sibling platform's file
    after a real collection run, in case gen-secrets.sh wasn't re-run.
  • Real collected data always overwrites the placeholder; nothing is ever
    clobbered.
• Update README.md and docs/firmware-reference-values.md, which had
  stale instructions to manually uncomment firmwareReferenceValues (it was
  never actually commented in the template).

Verification

• bash -n on all touched shell scripts.
• Manually simulated gen-secrets.sh end-to-end (stubbed jose): confirmed
  both refval placeholders are created and the printed instructions match
  the new defaults.
• Verified values-secret.yaml.template parses as valid YAML in both its
  default (commented) state and after running enable-airgap-secrets.sh
  (confirmed registryCaCert + bootstrap_secrets appear correctly, and
  the script is idempotent on repeated runs).
• make help picks up the new enable-airgap-secrets target correctly.