fix: persist and recover the Agent's real installation_id (heartbeat activation)

POST /v1/agents/enroll now returns installation_id; new installs persist it
to agent.env immediately. Runtime recovery precedence: existing SQLite
installation_identity -> configured INSTALLATION_ID -> authenticated
GET /v1/agents/me/identity. Recovery fails closed on missing/malformed/
mismatched identity rather than inventing a UUID (which the Hub would then
reject as a conflicting Installation on an already-enrolled Agent). An
explicit AGENT_JOBS_ENABLED gate stops the service from claiming a job right
after the first heartbeat.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

agent/tests/test_client.py

@@ -0,0 +1,34 @@
+import httpx
+
+from gti_fiscal_agent.client import HubClient
+
+
+def test_identity_requests_authenticated_identity_only(monkeypatch):
+    calls = {}
+    payload = {
+        "agent_id": 2,
+        "installation_id": "00000000-0000-4000-8000-000000000222",
+        "hostname": "DESKTOP-B0HL02I",
+        "version": "1.1.1",
+        "status": "OFFLINE",
+    }
+
+    class Response:
+        status_code = 200
+
+        def raise_for_status(self):
+            return None
+
+        def json(self):
+            return payload
+
+    def fake_get(url, *, headers, timeout):
+        calls.update(url=url, headers=headers, timeout=timeout)
+        return Response()
+
+    monkeypatch.setattr(httpx, "get", fake_get)
+    client = HubClient("https://hub.example", "test-agent-token")
+    assert client.identity() == payload
+
+    assert calls["url"] == "https://hub.example/v1/agents/me/identity"
+    assert calls["headers"] == {"Authorization": "Bearer test-agent-token"}