"This Mac is already managed by another MDM ... macOS allows only one MDM enrollment per device."

### Component

coordinator (Go)

### Problem / motivation

I'm running Darkbloom 0.8.10 on an Apple M5 Max (128 GB) running macOS 26.

`darkbloom status` reports:
"verified by Secure Enclave, but NOT yet hardware-trusted"
and:
"receive NO traffic until the coordinator's MDM verification completes."

Running `darkbloom enroll` fails because the Mac is already enrolled in my university's SimpleMDM instance:

"This Mac is already managed by another MDM ... macOS allows only one MDM enrollment per device."

This is a university-managed Mac, so removing the existing MDM enrollment sounds illegal...

Is there a supported way for Darkbloom to hardware-trust a Mac that is already enrolled in another MDM? Can the existing MDM attestation be used, or is there another enrollment path for institutionally managed Macs?

### Proposed solution

Allowing more than one mdm enrollment?

### Alternatives considered

_No response_

### Scope notes

_No response_

Start with the coordinator (Go) and the darkbloom enroll and status entry points. Investigate how MDM verification and hardware trust currently depend on enrollment, and whether macOS permits using an existing institution-managed attestation. Done means a supported path is defined for already-managed Macs, with its security and enrollment constraints documented and validated.

Written by the indexing model from the issue text.