Verify Central tokens during bootstrap

Uses staged IMDS JWKS issuer during bootstrap window, then persisted configuration after completion.