phase2: declare main tree-lock tools in enrolment during sync #8 #1968

Main's tree-lock tools need Phase 2 enrolment declarations when syncing v0.47.0.

Reproduced while merging exact main 3d8a14b49e88a59a37e1d3501891afe2d430ffcb into phase2-numbers at db349464b0f8ed1db0aa29ef14315fd45fe63156 (#1758, sync #8):

bash tools/enrolment_check.sh --selftest

The seven-case selftest exits 1 because its healthy control reports tools/make_lock_check.sh and tools/tree_lock.sh as invoked by no workflow. The main-side lock selftest itself passes 8/8.

The Phase 2 checker explicitly does not follow Makefile calls, local hook roots, or tools/ commands from the selftest registry. The existing declaration file is the appropriate representation: make_lock_check runs through its registry row in changed-file CI and nightly; tree_lock runs on every make through the parse-time shell and from the local Stop hook. No discovery matcher or count pin needs changing.

Prepared in the uncommitted sync #8 tree: add those two reasons to tests/enrolment_exemptions.txt. Actual results: enrolment selftest checks=7, rc=0; production enrolment rc=0; deleting the tree_lock declaration makes the production gate exit 1 naming that tool; restoration exits 0. Full merge validation remains separate and is not claimed here.

Done when

• The two invocation declarations land with the sync, preserving the checker and seven-case pin.
• bash tools/enrolment_check.sh --selftest exits 0 with checks=7.
• bash tools/enrolment_check.sh exits 0 on the merged tree.
• The recorded deletion probe fails by naming tools/tree_lock.sh; its restored control passes.