Release a commissioning host to active (admin).

One-shot commissioning -> active gate: called by add-worker.sh's release step after every post-check passes (xhost-git, the git-over-SSH hop, negative port scans), and by the operator via xhostctl admin host activate if add-worker died between the token exchange and its release step. No freshness guard: add-worker step 9 has just verified the heartbeat.

• commissioning -> active (OK).
• pending -> 400: no enrollment yet; run add-worker first.
• active -> 409: loud on stale re-run rather than a silent success (the operator should notice the cell was already released).
• draining / quarantined -> 400: those are gate-release states owned by the reactivate route, not commissioning.

Registers the host's agent in the same transaction, because commissioning is outside the serving set the boot populator reads. add-worker.sh normally calls this seconds after the token exchange registered one, but a control-plane restart in between — or an operator running xhostctl admin host activate later, which this route exists for — leaves a serving host with no agent.