[SaladDay]

Summary

Phase 2a of the new-user install work is the Core side of adding a node with one command. The installer's sudo mode (2b) follows separately.

• enrollment_id: POST /core/v1/sandbox/enrollment-tokens returns a non-secret enrollment_id, a random UUID that is not derived from the token. A node records it at registration, and the /core/v1/sandbox/nodes list and detail return it (null for older nodes). With it, Web can match the node a command registered exactly. Migration 000077_node_enrollment_id.
• Enrollment carries the node's address: POST /api/v1/sandbox-node/enroll now requires core_url.
  • A missing value gets 400.
  • A value that differs from Core's public URL gets 409 sandbox_node_address_mismatch. That is checked before the token is consumed, so a retry with the right address works until the token expires.
  • An invalid or foreign token still gets 401 before any deployment state is revealed.
  • parsar-sandbox-node sends the address.
  • After a mismatch the node installer removes its unregistered local state, so a new command works on the same host.
• Node restarts:
  • Node units keep retrying every 5 s with no start limit, so a node outlasts a Core outage.
  • Only a 401 (credential rejection, i.e. a removed or retired node) makes parsar-sandbox-node exit 78, which systemd does not restart.
  • A 403 from a proxy or WAF stays retryable.
• Artifacts only from the console: nodes and self-hosted executors download artifacts and metadata only from the console origin, even when the build recorded a GitHub release URL. Every redirect is refused. Integrity checks are unchanged.
• Console: /console/config adds node_artifacts, the providers whose node files the console holds. It is checked on every request and is always an array. The config keeps all five fields.
• Docs:
  • CONTRIBUTING allows a root-owned system service for the planned sudo mode (phase 2b) and describes the restart rule.
  • The install and node guides, sandbox-deployment.md and the machine OpenAPI are updated.

Behaviour change: a local node installed from a thin bundle now needs the release assets placed in <bundle>/artifacts/, because the GitHub fallback is gone. The install guide says so.

Review

• Independent blind review found no P0 or P1.
• The P2 (redirects were followed across origins) and the P3s were fixed in 82e20013: 409 cleanup, 403 no longer permanent, CONTRIBUTING wording, exit-code table test, test placement, and node_artifacts as an array. These were verified by tests and the gate, per the small-fix rule.

Verification

• Full local server gate on b2e05a27, the exact head, which includes main 97a617d7 (Give deployment default model providers one home and close the self-hosted model gap #140, Park rejected self-hosted executors and replace their credential in place #142): passed.
• Playwright browser cases were skipped on the server, where Chrome is unavailable (an approved skip).
• Migrations run 000075, 000076, 000077 in order. Up and down were checked on seeded data.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}