feat: ROOT_PASS=KEEP keeps the password set before the first boot

[marcos-mendez]

An unattended first boot after pct create --password had to repeat the password in ROOT_PASS. ROOT_PASS=KEEP (any case) now keeps it.

• setpass.py --pass=KEEP is accepted exactly when the screen would offer Keep, through the same keep_offer() (build date present, password usable and changed on or after it, not empty or the placeholder, not under keel-init). No logic is duplicated.
• Otherwise: Error: ROOT_PASS=KEEP: ... on stderr and exit 1, the convention of fqdn.py / secalerts.py for an invalid preseed; run logs the failed hook and goes on. KEEP is never set as the password and no screen is drawn. The shadow field is never printed.
• README preseed list and notes, 30rootpass comment, changelog 2.3.6+keel24.

Test plan

• tests/test_setpass.py: new TestPreseededKeep (accepted after build, on build day, any case, outside a container; refused when locked, empty, older than the image, no build date, placeholder, keel-init; a password merely containing KEEP is set). Failed before the change, pass after.
• Full pytest under coverage (99%), full bats suite, shellcheck.
• Security review by the maintainer.
• On a built image: pct create --password + ROOT_PASS=KEEP headless first boot keeps the password.