feat(devops): local GitLab secret bootstrap + integration registration scripts

Adds PowerShell helpers to seed the local Stella Ops stack with a working
GitLab + integrations configuration:
- bootstrap-local-gitlab-secrets.ps1 provisions GitLab's JWT signing secret
  and admin PAT into Vault/Authority.
- register-local-integrations.ps1 POSTs the canonical integration records
  (GitLab, Jenkins, Harbor, Gitea, Nexus, etc.) against the Integrations
  service for first-run local environments.

Docs: INSTALL_GUIDE.md + integrations/LOCAL_SERVICES.md document the new
helpers. devops/compose README and router-gateway-local.json get the
corresponding route wiring. Two new sprint files track the follow-on work
(SPRINT_20260413_002, SPRINT_20260413_003).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/integrations/LOCAL_SERVICES.md

@@ -86,6 +86,59 @@ docker compose -f docker-compose.integrations.yml ps
 docker compose -f docker-compose.integrations.yml ps gitea
 ```
 
+### 4. Register the local integration catalog
+
+After the core stack plus the local provider lanes are running, register the
+catalog entries that Stella Ops can exercise immediately from a fresh local
+install:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File scripts/register-local-integrations.ps1 `
+  -Tenant demo-prod
+```
+
+This converges the default local-ready lane to 13 healthy entries:
+- Harbor fixture
+- Docker Registry
+- Nexus
+- GitHub App fixture
+- Gitea
+- Jenkins
+- Vault
+- Consul
+- eBPF runtime-host fixture
+- MinIO (`S3Compatible`)
+- StellaOps mirror
+- NVD mirror
+- OSV mirror
+
+Optional GitLab providers require Vault-backed credentials. The recommended
+local flow is:
+
+```powershell
+# Reuse or rotate the local GitLab bootstrap PAT and write it to Vault.
+powershell -ExecutionPolicy Bypass -File scripts/bootstrap-local-gitlab-secrets.ps1 `
+  -VerifyRegistry
+
+# Register SCM + CI using the bootstrapped authref://vault/gitlab#access-token
+powershell -ExecutionPolicy Bypass -File scripts/register-local-integrations.ps1 `
+  -Tenant demo-prod `
+  -IncludeGitLab
+
+# Also requires GitLab registry enabled; uses authref://vault/gitlab#registry-basic
+powershell -ExecutionPolicy Bypass -File scripts/register-local-integrations.ps1 `
+  -Tenant demo-prod `
+  -IncludeGitLab `
+  -IncludeGitLabRegistry
+
+# Or do the GitLab-backed registration in one step
+powershell -ExecutionPolicy Bypass -File scripts/register-local-integrations.ps1 `
+  -Tenant demo-prod `
+  -IncludeGitLab `
+  -IncludeGitLabRegistry `
+  -BootstrapGitLabSecrets
+```
+
 `docker-compose.testing.yml` is the separate infrastructure-test lane. It starts `postgres-test`, `valkey-test`, mocks, and an isolated Gitea profile on different ports; it does not start Consul or GitLab.
 
 ---
@@ -206,7 +259,7 @@ vault kv put secret/jenkins api-token="your-jenkins-token"
 # Store Nexus admin password
 vault kv put secret/nexus admin-password="your-nexus-password"
 
-# Store GitLab PATs for API and registry access
+# Store GitLab PATs for API and registry access (manual override path)
 vault kv put secret/gitlab access-token="glpat-your-token" registry-basic="root:glpat-your-token"
 ```
 
@@ -326,12 +379,14 @@ GITLAB_ENABLE_REGISTRY=true GITLAB_ENABLE_PACKAGES=true \
 **Stella Ops integration config (SCM / CI):**
 - Endpoint: `http://gitlab.stella-ops.local:8929`
 - AuthRef: `authref://vault/gitlab#access-token`
+- Bootstrap helper: `powershell -ExecutionPolicy Bypass -File scripts/bootstrap-local-gitlab-secrets.ps1`
 
 **Stella Ops integration config (Registry):**
 - Endpoint: `http://gitlab.stella-ops.local:5050`
 - AuthRef: `authref://vault/gitlab#registry-basic`
 - Secret format: `username:personal-access-token` (local default: `root:<token>`)
 - The Docker registry connector follows GitLab's `WWW-Authenticate: Bearer` challenge and exchanges this basic secret against `/jwt/auth` before retrying catalog and tag probes.
+- `scripts/bootstrap-local-gitlab-secrets.ps1 -VerifyRegistry` reuses a valid local Vault secret when possible and otherwise rotates the local `stella-local-integration` PAT before writing both authrefs.
 
 ---