## Summary

Adds the qualification-first Phase 2 node-enrollment planner for the Overdeck K3s migration.

## Included

- one-command `tools/k3s/enroll-node.sh <tailscale-name>` planning entrypoint;
- deterministic 17-step Phase 3 transaction contract;
- read-only candidate and control-plane inspectors;
- durable plan-bound ledger and rollback ordering;
- protected Node identity, quarantine, proof-Job and token-revocation contracts;
- paired fleet/buildbox registry previews with `execution=none`;
- independent fail-closed receipt validation and recursive secret scanning;
- fixture, unit, failure-injection and deterministic shell tests;
- design, implementation report, runbooks and interactive presentation.

## Safety boundary

Phase 2 cannot create a K3s token, install or join an agent, change a candidate host, write Kubernetes resources, alter tracked registries, authorize Phase 3 or merge this pull request. Git publication occurs only after an independent zero-mutation receipt passes.

## Review gate

Keep this PR draft and unmerged until the generated Phase 2 result archive has been reviewed. The next package will be a separately authorized Phase 3 canary enrollment transaction.

## UI

No product UI or UI primitive changes. Astryx is not required for this phase.