feat: add Multica task-bound pool access

[hongzexin]

Summary

• add one-command employee enrollment with poolctl enroll
• exchange Multica mat_ task context for short-lived mcx_ pool credentials
• reject standalone company-pool use and remove legacy local keys during enrollment
• document the formal CHEK workflow and add GitHub Actions CI

Security properties

• no permanent employee API key
• credentials only mint inside a Multica task
• task/user/agent/workspace binding travels on every request
• credentials stay out of disk

Tests

• python3 -m pytest -q (71 passed)
• python3 -m compileall -q corp_codex_pool
• installed editable package and verified poolctl enroll --help