Enable Schedule

Enable one EventBridge rule — server-side half of Rule 6 v2.

Refuses unless fresh evidence says may_self_enable is true: TIER_PM, every pre-flight check green, not already enabled, and not pinned in the registry (a human hold that survives even a green pre-flight). A rule is never enabled on a tier the CALLER supplies — only on the tier this handler derives right now.

Does NOT touch scripts/deploy/schedule_registry.yaml — the registry is git-tracked and updating it is a PR like any other registry change; the PM opens that PR itself in the same session (Rule 6 v2's "records enabled: true in the registry the same session"). This endpoint's job ends at the live AWS state.