Enroll a Machine with one idempotent verb and read its join token from Inspect#1665

Fourth PR of the Machine RPC catalog simplification. One idempotent Enroll replaces Initialize and Join, and Inspect reports the join token. MachineToken goes.

What changes

• Enroll takes as: founder {...} or as: member {registration} plus wireguard_mtu. A fresh Machine stores the enrollment and restarts. A resend that names the stored Machine and MTU replays it without a restart. Anything else answers refused with the Machine's current id, phase and record, and stores nothing.
• The CLI resends Enroll until a reply arrives. The lost-reply recovery in ployz server init, ployz server add and ployz cloud enroll goes, because a resend now replays.
• Inspect takes token: {public_ip} and then returns token. public_ip_override goes. The CLI reads a missing token as an old daemon and says to upgrade Ployz on that Server.
• Register stops reading other Machines' rows. It drops the clash check and the isolation lock, and a Register for an existing id overwrites its row. Cloud owns enrollment concurrency, and it drops its conflict mapping in enrollment.server.ts.
• RuntimeWatch moves to the Cluster capability group. Its route, shapes and capability name stay.
• core/DESIGN.md names Initialize, Join and MachineToken as removed under rule 6 with no shim.

Who notices

Nobody during the window before the release. Cloud only calls Register on the entry Machine, and that route is unchanged. A newcomer installed from the script runs the current release for both CLI and daemon until the release. After the release, a new CLI against a Server on the current release refuses at ployz server init or ployz server add and says to upgrade that Server first.

Draft until the top of the stack is verified end to end.