Classify first-run bootstrap endpoints

tools/inventory/endpoint-surface-declarations.json

@@ -343,6 +343,20 @@
       "rationale": "Published integration, interoperability, public-participant, or health endpoint.",
       "repository": "govoplan-calendar"
     },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/bootstrap/first-admin",
+      "rationale": "The restricted first-run endpoint is consumed by the local bootstrap handoff and can only create the first durable administrator.",
+      "repository": "govoplan-core"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "GET",
+      "path": "/bootstrap/status",
+      "rationale": "The local bootstrap handoff reads only minimum first-run readiness before a normal authenticated shell exists.",
+      "repository": "govoplan-core"
+    },
     {
       "category": "public_integration",
       "method": "GET",