client-enrol: republic-laptop pubkey + hello.yaml recipient

Phase 2 first workstation enrolled. age1vf8... is republic-laptop's
issued pubkey; added as a recipient on hello.yaml so the post-bootstrap
decrypt test works there.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

inventory.yaml

@@ -351,7 +351,7 @@ hosts:
     os: linux
     role: primary-dev
     mesh: {netbird: {fqdn: republic-laptop.netbird.selfhosted}}
-    age_pubkey: ""
+    age_pubkey: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
 
   mac-mini:
     kind: workstation