Adds addresses to a pool for monitoring.

Business Rules:

• At most 1000 addresses per request.
• Chain and address are canonicalized (network names resolve to their chain class; case-insensitive addresses are lowercased) before enrollment.
• Each address this call enrols is screened against every risk config bound to the pool; the seeded risk level is the highest level whose config found risk (LOW = no risk found). An address already live in the pool is not re-screened and its baseline is left as it was.
• Every address gets a per-address outcome in results: ADDED, RESURRECTED (a previously removed address re-enrolled with a fresh baseline), SKIPPED_DUPLICATE (already live in the pool - the existing member is untouched), or INVALID (an address-level problem or no screening verdict, with a reason - the rest of the batch still enrolls; the entry is echoed canonically unless canonicalization is what failed).
• An entry naming no chain at all, or a chain outside the supported set, rejects the WHOLE request with InvalidArgument naming the offending entries by position (a recognised but unmonitored chain is named by its resolved class) and listing the supported classes; nothing is screened or enrolled.
• A seeded level in the pool's open_case_risk_levels set opens a case.

Timeout contract:

• The external request budget is 30 seconds (Linkerd/Emissary). The handler applies a 25-second end-to-end enrollment budget covering all phases (pool gate, screening, enrollment transaction). If the budget expires before the enrollment transaction commits, the request returns DeadlineExceeded; a timeout during or after the commit means the enrollment outcome is ambiguous and the caller should re-check.