Require enrollment_id on sandbox nodes in the client

[SaladDay]

Summary

Makes SandboxNode.enrollment_id a required string | null in packages/agents-client.

• Core has always returned it since Match enrolled nodes exactly, check their Core address and serve artifacts only from the console #144: null for nodes enrolled earlier, otherwise the enrollment's ID.
• The Web now sets it everywhere (Follow the added node by its enrollment ID and say when node files are missing #145).
• A client test pins the type and runtime values.
• No contract change.

The sandbox admin client does not validate node response shapes at runtime today, for any field, so this is enforced at compile time. A strict runtime projection for node reads, matching the admin client's other projections, is a separate follow-up.

Verification

• agents-client typecheck and 602/602 tests passed; root pnpm typecheck passed; apps/web 362/362 passed.
• The full local server gate on 6e8efad5, the exact head including main 65c4d30b, passed. The Playwright browser cases were skipped on the server (Chrome unavailable; approved skip).
• Review: self-review. This is a one-line type change plus a test.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}