Freeze tolerant daemon store and enrollment contracts #989

Parent

Spec: 1.0 tree cleanup and release contracts

What to build

Make 1.0 daemon-facing data additive and readable across 1.x: replicated bodies, typed Certificate Material, local Machine record, Machine RPC, and enrollment protocol 1. Drop replicated timestamps and make the WireGuard port a constant.

Acceptance criteria

• Every replicated body has an unknown-field reader regression check and retains defaults for future optional fields.
• No new version gate or store migration is needed; forbidden fields still fail explicitly where required.
• Enrollment protocol 1 and typed certificate read/write round-trip through existing integration seams.

Blocked by

None — can start immediately