Enroll a Founding Machine and open it from Cloud through Tailcat #879

Parent

#868

What to build

The authenticated enrollment flow installs/publishes a protected Tailcat candidate, verifies the intended Founding Machine, completes its current attempt and opens the Machine from Cloud without Relay List or a held relay registration.

Acceptance criteria

• Reuse the transactional assignment and Founding Claim semantics delivered by Make Cloud enrollment use transactional assignments #864. Preserve serialization, founder resumption and retry behavior; absence, timeouts or failed transport never authorize founder reset or claim transfer.
• Repurpose the retired organizationMachine schema as minimal encrypted connection metadata scoped to Organization, Machine and current Cluster pairing; reuse active equivalent records if present. Remove compatibility/membership meaning; add no second catalog, generic repository or live-presence service.
• Persist the authenticated candidate against the current attempt before completion. Complete only after shared negotiation confirms intended Machine identity; capabilities stay encrypted/backend-only.
• Keep OrganizationRuntime.open and its connected/no-connection/unreachable outcomes. Its single-candidate path calls the SDK shared connection interface without Relay List; saved metadata does not prove reachability or Cluster membership.
• Rung 2 — PostgreSQL enrollment/runtime contracts for pre-completion publication, unauthorized and stale attempts, scoped/colliding Machine IDs, founder resume, identity mismatch and actual single-entry connection outcomes. Update the affected design/glossary/ADR decisions alongside this behavior.

Blocked by

• Install and upgrade the persistent Tailcat endpoint #877
• Use Tailcat through the Node SDK on the actual Cloud host #878