Manage agency enrollments using a strict reviewed command.

IDs are in the body. Runtime refinements, current role, assignment and exact approval/hash/lease guards apply. Enrollment creation and commit require a stable Idempotency-Key. Installation run_scenarios also requires evals:write. Care requires sms:write and exact owner approval; preparation creates a draft, launch explicitly queues it. Provider-unknown outcomes require reconciliation. Configuration, testing, activation, billing and measured outcomes are distinct.