fix: install bws from the private tier, not the manifest

The previous commit put the bws install on the private/bws-secrets row as
a tarball channel. That row can never install anything: selected_packages
drops every row flagged `private`, which is the invariant that makes
--unattended safe to run. The container proved it — unzip installed, bws
did not, and the row still could not deliver on its promise.

Nor can it be a safe row: the defaults preset ticks every safe package, so
that would put a Bitwarden binary and a 12 MB GitHub download on every
throwaway public VM, for a tool those machines have no credential to use.

So ensure_bws lives in dotup and is called from cmd_private immediately
after the token is written. Nothing installs bws unless something is about
to hand it a token, and the manifest keeps its invariant.

core/unzip stays a real package with the @needs edge — the release is a
.zip and 24.04 minimal has no unzip.

dot_local/share/dotup/packages.tsv

@@ -118,4 +118,4 @@ virt	libvirt	invasive	libvirt-daemon-system	-	daemon + group membership
 virt	virt-manager	invasive	virt-manager	-
 @private	one password, typed after the install finishes
 private	private-repo	private	-	-	~/.local/share/dotfiles-private — agent config, ssh config
-private	bws-secrets	private	-tarball	-tarball	installs bws, then 7 API keys into ~/.config/zsh/secrets.zsh
+private	bws-secrets	private	-	-	bws + 7 API keys into ~/.config/zsh/secrets.zsh; the tier installs bws itself