feat(dcap): decouple PCK provisioning lifecycle

[butler54]

Summary

• Make the Makefile the primary interface for DCAP collateral and PCK lifecycle actions.
• Separate platform-independent collateral collection from platform-specific PCK export, generation, and import.
• Support a connected bastion and high-side/low-side transfer bundles with platform-set validation.
• Resume an interrupted connected-bastion provision by reusing matching request and unexpired response bundles.
• Discover the QGS DaemonSet from the pck-certs-watcher pod owner reference.
• Fix DCAP/PCK expiry command failure propagation and document the lifecycle.

Validation

• pytest -q: 14 passed
• Shell syntax checks
• Python compilation
• make help
• git diff --check

Live Validation Pending

• Resume connected-bastion import and QGS rollout from the generated response bundle.
• Split high-side/low-side export, generation, and import workflow.

Closes #149