client-enrol: republic-laptop pubkey + hello.yaml recipient

Phase 2 first workstation enrolled. age1vf8... is republic-laptop's
issued pubkey; added as a recipient on hello.yaml so the post-bootstrap
decrypt test works there.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.sops.yaml

@@ -22,7 +22,8 @@ creation_rules:
     # they enrol; re-key with `sops updatekeys -y secrets/hello.yaml`.
     age: >-
       age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
-      age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
+      age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0,
+      age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
 
   - path_regex: ^secrets/gitea-tokens\.yaml$
     # Workstations only.

hosts/republic-laptop.yaml

@@ -13,5 +13,6 @@ mesh_globals:
   accepted:
   - netbird
   - tailscale
+age_pubkey: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
 mcp_endpoint: https://mcp.hubris.network/sse
 secrets_issuance_endpoint: https://secrets.hubris.network/issue

inventory.yaml

@@ -351,7 +351,7 @@ hosts:
     os: linux
     role: primary-dev
     mesh: {netbird: {fqdn: republic-laptop.netbird.selfhosted}}
-    age_pubkey: ""
+    age_pubkey: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
 
   mac-mini:
     kind: workstation

secrets/hello.yaml

@@ -9,20 +9,29 @@ sops:
         - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKQjZrSWpEbCsvNlB0NTdh
-            MU9hN3pSU1lkVXM0OUFqNUsrWUVlR3ExU2lVCjF2U3BCc0xlMHRPcEY2ZkdKZW41
-            TTlRNVBRbzlHVTh2T0krRTAzaFFMUnMKLS0tIG8vTTAyNlc5RXNOdkR4cWVKTGtk
-            NE9xeXRKR0c5Q1k3OVhzQmtYeHpjamsKdSfpAKgJaas7AhlUTplzcnMsAI/1NBJ4
-            uWD0IlJsIR3B2l/3h5LgrhkyQj/hLI5pFMptNwLXQUjN+Kleq5v/QQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQXlnbG4zZlNTbDduSENL
+            b295UkVWcUpXMkxPSS9WTW9TRCs0aWx0WXg0ClpJVE9KU1ZRYVdtTFFtMktkdnBB
+            NFFTYjIxL0F2M3M4a2VBRXVYYWJKbE0KLS0tIFpPTFY5QjVDWUw2ODcyQWx0NmpP
+            eGJRbHBqWTgvVnZCN0Mrc29pblpieUkKDWqdmZMPvFC2Eaql9KHG19Pi0ek4/cKE
+            bewjSZ/7GZ/ov3xBFWjBVfBepeWnwwrd1NgBKPckm6wMxDPZU5gTag==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxaWFOOWI3cFMrWGt1RGow
-            RE5icW1rVEIraGExWWlqSmQ2aGh6aVNoS2hjCjZyRzBCZGpyczRySmErYkNPWHBM
-            N0RweWVmeUlQK1lNTnFQN1VqMVZlalUKLS0tIGpnNzRlaUJSVkE0RDVSRXBqV2t0
-            b09sVU9neWRPYkdVSmhRd3pZelkzTmsKEEvuq8cVtX/zVji3V+SqX/4cZitBD20U
-            w5NUMIT8gXHBVE5uTXqRmFPXGD9PgnCy0CZbE9CguZwav8a4KGYOPw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnWENBRzR5UTNkdStOOVps
+            QjVreEZqZWZmcmxMZEFJbEtUOGNkYlZXOGlZCm81OE9RK1ljTVJ0K0tHM2xzaEFq
+            Um1zR1loTmVDVUxyU0VPSXo1YzNkczQKLS0tIHBnR1N1dlhTQ0pnNTU1a3FIaE9l
+            dHJxTXRXWWo2Njd6eVJYeUc4RXR0YVkKGtia6ZGBXmNTzBTNA4fVvIT0h+2egC6I
+            mzilX73imv5ytxbS88jvT8t/qeb8m5he4dybWx1FKaikKlkqRWCygg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmVmkydnptdWQyczVWeVNw
+            YkZsZUR0VzJjeGRnNG9VV1NWUWpPb0lRaDNBCnhxTExybG5OcVdic0lWUjM3dGNL
+            R2NqL2FxVjFOR1d4VnlFK0pMeFg2Y00KLS0tIFpEV1BWR05qd0dWbEJVSFo4cjRN
+            R0prZ0NyWjlJUzFYV2JwSnZmY2tBeGMKki3BOJlofZV759eKgqO3JJfJbZyygMqV
+            DmPcrwQUEXZcB5p9CRb2Y87utL0DdYJBvreiPGRLcEZxrK60RyhPEA==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-05-20T14:39:14Z"
     mac: ENC[AES256_GCM,data:CAoIW1sJkIbNoXMaVlXwfHdREzATNqDKpSN5ecaSiRARThB0/tcLNbkazXKyV1Rx5b+b3s+yCpBzwmNnH6ytaCzG5pKPcnfd6YJq7C5rm/EQHyaVGrPdBsSfqiz4yBXKClej//v3+qkD5Ls2PMppv5KmqigOKNQC/ot3ht2c7lM=,iv:eOmDDclksr9f9CDu6dJprSFwlWuoggzVFjyfqWf5Uhg=,tag:IU3sMlIi92ohM86zOIJdAg==,type:str]