v2.4.2 — Sanity audit cleanups: enrollmentRole gate + farm draft slot
Post-v2.4.1 sanity audit cleanups
Cross-mode audit (Regular / Master / Slave-workforce / Slave-farm) surfaced two real gaps. Everything else — wake-dispatch farm guard, migration v71 copy, telemetry runtimes optional field, ConversationServiceImpl 'farm' case, command-type registry, AgentType exhaustive switches — checked out clean.
1. enrollmentRole gate on farm commands (defense in depth)
Neither team.farm_provision nor agent.execute verified the slave's enrolled role before executing. A workforce slave that somehow received one (misconfigured master, stale replay, or a compromised master assuming signed-envelope bypass) would silently materialize a mirror team it can't actually run. Both handlers now fast-skip with reason: 'not_farm_role' when ProcessConfig('fleet.enrollmentRole') isn't 'farm'. Signed envelope still verifies — this is a second-layer sanity gate so boundaries don't leak even if the first layer is wrong.
2. Missing 'farm' case in SendBoxDraftStore
The store.farm bucket was added in v2.2.0 but the setDraft / getDraft switches in useSendBoxDraft.ts still fell through to default. FarmSendBox uses local state today so it doesn't rely on the hook, but any future code path that does would silently drop all draft mutations. Both switches now handle 'farm' correctly.