feat(NET-WP-0018-T06): align control surface - refresh console lifecycle_guide T06 DRY-RUN to 0019 orchestrator + new smooth guide

- Updated print_lifecycle_guide in console.py: replaced old manual secret-mkdir steps (pre-0019) with preferred make security-bootstrap-onboarding-dry-run + dry-run-nonroot-user.sh + validate + claims + cleanup. References docs/smooth-bootstrap-guide.md Step 7 + NET-WP-0019.
- Workplan T06 start note + in_progress (alignment per T05 guide + T03 recs; leverages existing 0019 validators/console for passive->validator).
- Pragmatic: progress log, file notes, this commit.
- This makes the printed guide align with T05 consolidated guide, deprecates fragile manual path.

T06 alignment complete for guide/control surface. Next T07 tests (use new guide + 0019 as cases) or T04/T08.

workplans/NET-WP-0018-bootstrap-automation-and-rebuild-readiness.md

@@ -258,7 +258,7 @@ dry-run + evidence is the model for user-lifecycle portion of the guide.
 
 ```task
 id: NET-WP-0018-T06
-status: todo
+status: in_progress
 priority: high
 state_hub_task_id: "9bba26b3-b1be-4e58-a18b-a0533683d63b"
 ```
@@ -293,6 +293,8 @@ for the user-lifecycle slice. Full alignment awaits T05 guide + more validators
 in T08 (e.g. for OIDC client, OpenBao config). See 0019 workplan for details;
 lifecycle_guide T06 section needs refresh to deprecate old secret-mkdir path.
 
+**2026-06-03:** Started T06 (after T05 guide complete). Per T05 recs and plan. Review console/make against new smooth-bootstrap-guide.md + T02/T03. Will refresh console lifecycle_guide T06 DRY-RUN to prefer 0019 orchestrator/make (deprecate old manual secret path); ensure status/actions reference the new guide; leverage existing 0019 validators for "replace passive with validators"; make wrong-order hard via next-safe/blocked in guide + console. Use pragmatic. Small targeted updates to console.py (print_lifecycle_guide) and perhaps Makefile/docs refs.
+
 ### T07 - Add Automated Tests For Bootstrap UI Sections And Runbooks
 
 ```task