mesh-cli: nox enrol open opens a sealed enrolment token locally with the operator's private key

The seat mesh-enrolment's tokens answers the token sealed to the operator key; the operator opens it at their own
terminal. The subcommand reads the sealed token on standard input and the private key from a file, prints the token text
a joining machine takes, asks nothing of the node-engine's socket, and says the token is not sealed to a wrong key
(ADR 0587 §6, §8). New: one table-style test function; mesh-cli had 6, so none was merged or deleted.

(issue 774, 774/S51)
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

modules/mesh-cli/go.mod

@@ -3,3 +3,7 @@ module mesh-cli
 go 1.26.0
 
 require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
+
+require golang.org/x/crypto v0.57.0
+
+require golang.org/x/sys v0.48.0 // indirect