feat: every agent and probe must have an owner passkey, enforced by the panel, the installers and fleet-enroll [CI]

backend/fleet/tools/fleet-enroll/Program.cs

@@ -33,6 +33,12 @@ if (Arg("--meta") is { } metaText)
 string? genesis = Arg("--genesis");
 string[] controllers = (Arg("--controllers") ?? "").Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
 
+if (genesis is not null && controllers.Length == 0)
+{
+    Console.Error.WriteLine("--genesis needs --controllers: every node has an owner (the passkey credential ids from the panel's command)");
+    return 2;
+}
+
 using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(30) };
 Result<EnrollmentResult> result = await EnrollmentClient.EnrollAsync(
     http, new Uri(server), join, name, directory, Arg("--version") ?? "0.0.0", meta, TimeProvider.System, CancellationToken.None, genesis, controllers);