feat(gateway,cli): agent enrollment command family (M4-4b) (#1483)

Co-authored-by: fred <[email protected]>

apps/gateway/src/validation-pipe-check.ts

@@ -13,6 +13,11 @@ import {
   TransferEstateDto,
   TransferPlatformProjectDto,
 } from './hierarchy/hierarchy.dto.js';
+import {
+  EnrollAgentDto,
+  EnrollCredentialDto,
+  GetEnrollmentQueryDto,
+} from './enrollment/enrollment.dto.js';
 
 /**
  * Boot-time self-check: the global ValidationPipe must be able to SEE the
@@ -105,6 +110,31 @@ export const PIPE_GUARDED_DTOS: Array<{
     target: ChangeGrantDto,
     properties: ['role', 'idempotencyKey'],
   },
+  {
+    name: 'EnrollAgentDto',
+    target: EnrollAgentDto,
+    properties: [
+      'harness',
+      'name',
+      'persona',
+      'model',
+      'provider',
+      'credential',
+      'idempotencyKey',
+      'correlationId',
+      'replayMode',
+    ],
+  },
+  {
+    name: 'EnrollCredentialDto',
+    target: EnrollCredentialDto,
+    properties: ['mode', 'type', 'value'],
+  },
+  {
+    name: 'GetEnrollmentQueryDto',
+    target: GetEnrollmentQueryDto,
+    properties: ['correlationId'],
+  },
 ];
 
 export class PipeMetatypeCheckError extends Error {