fix: persist and recover the Agent's real installation_id (heartbeat activation)

POST /v1/agents/enroll now returns installation_id; new installs persist it
to agent.env immediately. Runtime recovery precedence: existing SQLite
installation_identity -> configured INSTALLATION_ID -> authenticated
GET /v1/agents/me/identity. Recovery fails closed on missing/malformed/
mismatched identity rather than inventing a UUID (which the Hub would then
reject as a conflicting Installation on an already-enrolled Agent). An
explicit AGENT_JOBS_ENABLED gate stops the service from claiming a job right
after the first heartbeat.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

agent/tests/test_state.py

@@ -1,3 +1,5 @@
+import pytest
+
 from gti_fiscal_agent.state import AgentState
 
 
@@ -18,3 +20,37 @@ def test_ipi_write_log_records_per_product_audit(tmp_path):
     assert log[0]["write_status"] == "SUCCEEDED"
     assert log[0]["before_value"] is None
     assert log[0]["proposed_value"] == "3.25"
+
+
+def test_installation_identity_requires_an_existing_or_explicit_id(tmp_path):
+    state = AgentState(tmp_path / "agent.db")
+
+    assert state.stored_installation_id() is None
+    with pytest.raises(ValueError, match="installation_id is required"):
+        state.installation_id()
+
+    assert state.connection.execute("SELECT COUNT(*) FROM installation_identity").fetchone()[0] == 0
+
+
+def test_installation_identity_persists_and_reuses_explicit_id(tmp_path):
+    db_path = tmp_path / "agent.db"
+    state = AgentState(db_path)
+    existing_id = "00000000-0000-4000-8000-000000000222"
+
+    assert state.installation_id(existing_id) == existing_id
+    assert state.installation_id() == existing_id
+    assert state.stored_installation_id() == existing_id
+
+    restarted_state = AgentState(db_path)
+    assert restarted_state.installation_id() == existing_id
+
+
+def test_installation_identity_rejects_conflicting_or_malformed_ids(tmp_path):
+    state = AgentState(tmp_path / "agent.db")
+    existing_id = "00000000-0000-4000-8000-000000000222"
+    state.installation_id(existing_id)
+
+    with pytest.raises(ValueError, match="conflicts"):
+        state.installation_id("00000000-0000-4000-8000-000000000223")
+    with pytest.raises(ValueError, match="UUID"):
+        state.installation_id("not-a-uuid")