Recognize owner local agent enrollment - #41

Root cause

Recovery treated every controller pin beside an owner marker as a worker-role conflict. An owner legitimately self-enrolls its local agent into its own controller, so the real 0.3.1 native check produced a false recovery warning.

Fix

• accept a complete owner-local agent enrollment only when its marker matches the pinned endpoint and the pin's Ed25519 governor public key derives from this owner's local governor key
• keep pending worker invites, incomplete identities, missing pins, mismatched endpoints, and foreign-controller pins fail-closed
• add regressions for both the valid owner-self-enrollment and foreign-controller cases

Validation

• current physical owner state: pin schema valid, local governor matches, enrollment endpoint matches, identity/key present
• cargo fmt --all -- --check
• cargo check --workspace --all-targets
• cargo test --workspace --no-fail-fast — desktop 21 tests
• cargo clippy --workspace --all-targets -- -D warnings
• scripts/Assert-RustSecBaseline.ps1 — 0 vulnerabilities