Run bootstrap automatically on enable paths when health is bad, skip bsipa in disable-all, and add tests for the shared bootstrap gate. Co-authored-by: Cursor <cursoragent@cursor.com>