The row lock from LockingStrengthUpdate only holds for the duration of
the surrounding transaction, so the settings read, the cluster
immutability check, and the save now share one via ExecuteInTransaction
— concurrent PUTs could otherwise interleave between them.
bootstrapSettingsIfNeeded takes the store to operate on so the
settings-PUT bootstrap participates in that transaction.
The bootstrap e2e now sets every toggle away from its default so each
assertion can fail, covers a post-bootstrap update without the cluster,
and verifies a rejected cluster change leaves the row untouched.
The suite's shared account is bootstrapped by the first provider-creating
test, so the fresh-account contract — GET reads as the defaults with an
empty endpoint, a cluster-less PUT fails, a PUT carrying a cluster
bootstraps and pins it — had no end-to-end coverage. Boot a dedicated
combined server for that starting state; the image is cached by
TestMain's build, so the cost is one container start.
