core: no seam for the enrollment client ceremony — a Workspace cannot cross-sign a second device and there is no safety-code function

[justin13888]

What

E2E case 12 (design/module-map.md) is "A authorizes B over a verified channel (enrollment code plus safety-code check) → B generates hardware keys → A cross-signs B into the device directory → B joins each album's MLS group → B's library matches A's". The server leg (code, relay channel, close, MITM abort) is landed in capsule-e2e/tests/case_12_enrollment.rs (#409, PR #463). The client half has no seams in the tree:

• Workspace keeps the user identity key private (capsule-core/src/lifecycle/mod.rs), so it cannot sign a directory that adds a second device; there is no Workspace::cross_sign_device(entry).
• There is no safety-code derivation over the two devices' advertised keys anywhere in capsule-core (rg safety finds only prose).
• A second device cannot bootstrap into an existing account (see the Workspace-from-master issue) and the MLS join is server-side membership work (server: server-side album membership (S-C51), which the blob 403 and album writes wait on #405).

Fix shape

Workspace::cross_sign_device(DeviceEntry) -> DeviceDirectory (bumps directory_version), a safety_code(a_keys, b_keys) -> String in crypto::keys, and the enrollment payload encoding, each unit-tested; then the client half of case 12 can land in capsule-e2e.