client-enrol: republic-laptop pubkey + hello.yaml recipient

Phase 2 first workstation enrolled. age1vf8... is republic-laptop's
issued pubkey; added as a recipient on hello.yaml so the post-bootstrap
decrypt test works there.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hosts/republic-laptop.yaml

@@ -13,5 +13,6 @@ mesh_globals:
   accepted:
   - netbird
   - tailscale
+age_pubkey: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
 mcp_endpoint: https://mcp.hubris.network/sse
 secrets_issuance_endpoint: https://secrets.hubris.network/issue