Add generation-bound TLS control face

Create ephemeral trust anchors, publish an exact-profile Unix control socket, and persist generation-authorized mTLS session registration through the Domain Store.

docs/schema.md

@@ -671,6 +671,46 @@ classDiagram
         coordinator_tls_certificate_sha256
     }
 
+    class ClientEnrollmentRequest {
+        <<serialized>>
+        protocol_version
+        generation_identity
+        cli_id
+        certificate_signing_request_der
+    }
+
+    class ClientEnrollmentResponse {
+        <<serialized>>
+        protocol_version
+        credential
+    }
+
+    class SessionRegistrationRequest {
+        <<serialized>>
+        protocol_version
+        session_binding
+    }
+
+    class SessionRegistrationResponse {
+        <<serialized>>
+        protocol_version
+        session_capability
+    }
+
+    class ControlRequest {
+        <<serialized>>
+        <<union>>
+        Enroll
+        Register
+    }
+
+    class ControlResponse {
+        <<serialized>>
+        <<union>>
+        Enrolled
+        Registered
+    }
+
     class SandboxCredentialBundle {
         <<serialized>>
         protocol_version
@@ -730,6 +770,14 @@ classDiagram
     ProtocolPublicationIdentity --> GenerationIdentity
     ProtocolPublicationIdentity --> TrustManifest
     ProtocolPublicationIdentity --> TlsCredential : coordinator TLS leaf
+    ClientEnrollmentRequest --> GenerationIdentity
+    ClientEnrollmentResponse --> TlsCredential
+    SessionRegistrationRequest --> SessionBinding
+    SessionRegistrationResponse --> SessionRequestCapability
+    ControlRequest --> ClientEnrollmentRequest : Enroll
+    ControlRequest --> SessionRegistrationRequest : Register
+    ControlResponse --> ClientEnrollmentResponse : Enrolled
+    ControlResponse --> SessionRegistrationResponse : Registered
     SandboxCredentialBundle --> GenerationIdentity
     SandboxCredentialBundle --> TrustManifest
     SandboxCredentialBundle --> ProtocolCredential : coordinator verifier