agent: P2-18c announce-and-approve enrolment path

When -enroll-server is supplied without -enroll-token, the agent
mints (and persists) an Ed25519 keypair, POSTs /api/agents/announce,
prints the SHA256 fingerprint in a copy-friendly banner, opens
/ws/agent/pending, signs the server's nonce, and blocks until the
admin clicks Accept (1h ceiling). On accept, persists the bearer +
host_id from the 'enrolled' message; on reject (close code 4001)
exits with a clear error.

Repo creds are pushed via config.update on the first standard WS
hello (P1-32 path), not in the enrolled message itself.

cmd/agent/main.go

@@ -59,8 +59,17 @@ func run() error {
 		return doEnroll(*enrollServer, *enrollToken, cfg, version)
 	}
 
+	// Announce-and-approve: -enroll-server set, no token, agent not
+	// yet enrolled. Run the announce flow inline; on success the cfg
+	// has the bearer + host_id and we drop into the normal run loop.
+	if !cfg.Enrolled() && *enrollServer != "" {
+		if err := doAnnounce(*enrollServer, cfg, version); err != nil {
+			return fmt.Errorf("announce: %w", err)
+		}
+	}
+
 	if !cfg.Enrolled() {
-		return fmt.Errorf("agent is not enrolled; run with -enroll-server and -enroll-token first (config %q)", *configPath)
+		return fmt.Errorf("agent is not enrolled; run with -enroll-server (and either -enroll-token or wait for admin to accept the announce) first (config %q)", *configPath)
 	}
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)