enroll

Add replica to the log-known roster, serialized through the log — the set a later barrier quantifies its acknowledgments over (docs/heddle-ledger-relocation-design.md §6.2). Idempotent: enrolling an already-enrolled replica is ControlOutcome.Applied.

Any peer may enroll any replica, because enrolling only ever enlarges that set: a wrong enroll makes a barrier wait for a promise that never comes (a liveness cost, and the same class as an unreachable enrolled peer), never lets one complete without a promise it needed.

A peer must enroll before it authors any entitlement, and that is now structural. The roster is what makes "every writer has promised" a well-defined question; a replica that spends, delegates, or completes without being enrolled is a writer no barrier is waiting for (§13.2). So enrolling self is what opens this node's isWritable boot gate — until it returns ControlOutcome.Applied here, reserve returns null and schedule delegates nothing.

It doubles as the §6.5.3 boot-ordering fence: submit returns only once this peer's apply loop has applied the entry, and Raft applies in index order, so a peer that has applied its own enroll has applied every entry before it — every quiesce mark this incarnation lost to a restart is restored before the first mutator can run. Do it on every boot, including a restart where the replica is already enrolled: the fold is then idempotent, but the act still commits, still applies, and still opens the gate (and it is also what re-attaches a lost peer's detector, #1652).