Function enroll 

pub fn enroll(conventions: Option<&str>) -> Result<(), String>

amont enroll — the machine-level standing grant, made one command.

The team-rollout problem in one sentence: hooks only protect the machines that installed them, and only npm repositories can self-install on clone. enroll is the other half — run ONCE per machine, it arranges for every FUTURE git clone and git init to arrive with the shims already baked:

1. the binary lands somewhere stable (install_binary’s rules);
2. the template dir is populated (populate_template_dir’s guards);
3. init.templateDir is pointed at it — the one write install always left to the user, because a standing grant should be typed, not inherited. enroll IS that typing.

With --conventions declared it also writes amont.conventions, so the grant is safe on a machine that clones other people’s projects: those get the safety net only, and the house rules wait for a committed amont.conf. See dispatch::conventions_apply.

Existing clones are deliberately untouched — a standing grant reaches forward, not backward. The output names the two remedies.