Only enlist session out-of-container; inside they're auto-enlisted

Enlisting twice yields weird "XAER-NOTA" and "xid has been replaced"
warnings that fail the tx.