tpm-enrol: allow enrolment under rd.dot1x=0 (test-mode) for bench testing

Removes the hard no-op on the test path so the enrolment flow can be exercised
on a host with a TPM + a reachable broker WITHOUT standing up 802.1X/MACsec/
RADIUS. Networking is now mode-aware: in test mode ip=dhcp already owns the NIC
(and wrote resolv.conf), so the hook uses the existing lease instead of running
its own nmcli DHCP — avoiding the dracut "address already assigned" race
(CLAUDE.md "don't double-configure the NIC in test mode"). Secure mode still does
the nm-unmanaged override for the pre-auth lease. rd.fleet.enrol=0 disables
enrolment in either mode; production intent stays secure-path-only.

docs/TODO.md

@@ -1024,6 +1024,14 @@ golang` + the 2d removal). `fleet-enrol` lands at `/usr/sbin` before the initram
 build (dracut `inst_simple`s it; asserted in `lsinitrd`), fapolicyd-trusted.
 New `enrol_url` Packer var → `rd.fleet.enrol_url` cmdline.
 
+**TEST-MODE ENROLMENT ENABLED (2026-07-02, temporary):** the hook no longer
+no-ops under `rd.dot1x=0` — enrolment runs on the open/test path too, so it can be
+exercised on a host with a TPM + the broker WITHOUT standing up
+802.1X/MACsec/RADIUS. In test mode `ip=dhcp` owns the NIC (the hook skips its own
+DHCP to avoid the dracut "address already assigned" race) and DNS resolves the
+broker via the lease. `rd.fleet.enrol=0` disables it. Production intent is still
+secure-path-only; revisit when the secure path is bench-verified.
+
 **TESTED (2026-07-02):** transaction logic (CSR → mock broker → approve → cert
 extract) as stdlib unit tests, AND the **full TPM ceremony (key-gen → persist →
 ECDSA sign → CSR verify → chunked NV write → re-enrol) against the go-tpm software