feat(device-core): protect enrollment identifiers

device-plane/services/device-control-core/test/app.test.mjs

@@ -75,6 +75,17 @@ test("management API cannot start without its repository boundary and strong tok
     }),
     /device_management_token_invalid/,
   );
+  assert.throws(
+    () => createControlCoreApp({
+      managementApiEnabled: true,
+      managementToken,
+      repository: {
+        health: async () => "ready",
+        executeManagementCommand: async () => ({}),
+      },
+    }),
+    /device_identifier_pepper_invalid/,
+  );
 });
 
 test("management API requires service auth and an idempotency key", async () => {
@@ -427,7 +438,7 @@ function ownerScopeCommand() {
 }
 
 async function startTestServer(options) {
-  const server = createControlCoreApp(options);
+  const server = createControlCoreApp({ identifierPepper, ...options });
   await new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", resolve);