Add smooth node enrollment flow

README.md

@@ -92,6 +92,12 @@ The bootstrap implementation provides:
 - `geth status`
 - `geth node id`
 - `geth node list`
+- `geth node enroll request --node-name <name> --capability <resource=capability> [--out <path>]`
+- `geth node enroll submit <owner-node> [--request-id <id>|--path <path>]`
+- `geth node enroll import <path>`
+- `geth node enroll list [--status pending|approved|rejected]`
+- `geth node enroll approve <request-id> --signing-key <private-key>`
+- `geth node enroll sync <owner-node>`
 - `geth node rename <node-or-name> <name> --signing-key <private-key>`
 - `geth node revoke <node-or-name> --signing-key <private-key>`
 - `geth node grant <node-or-name> <resource> <capability> [--grant-id <id>]`
@@ -106,6 +112,7 @@ The bootstrap implementation provides:
 - `geth keychain init [--admin-key <path>] [--signing-key <path>]`
 - `geth keychain status`
 - `geth keychain sync <node-id-or-name>`
+- `geth auth sync <node-id-or-name>`
 - `geth secret status`
 - `geth secret create <resource>`
 - `geth secret rotate <resource>`
@@ -366,6 +373,32 @@ geth node grant work-laptop resource:ssh-proxy:local ssh_proxy.connect
 geth node revoke work-laptop --signing-key ~/.ssh/id_ed25519_sk
 ```
 
+The enrollment flow for a new node is:
+
+```sh
+# On the new node:
+geth node enroll request \
+  --node-name workstation \
+  --capability resource:ssh-proxy:local=ssh_proxy.connect \
+  --out /tmp/workstation-enrollment.json
+
+# Either submit over Iroh to an imported owner peer:
+geth node enroll submit owner-laptop --path /tmp/workstation-enrollment.json
+
+# Or import the JSON on the owner/YubiKey machine:
+geth node enroll import /tmp/workstation-enrollment.json
+geth node enroll list --status pending
+geth node enroll approve <request-id> --signing-key ~/.ssh/id_ed25519_sk
+
+# Back on the new node, pull signed identity and authorization state:
+geth node enroll sync owner-laptop
+```
+
+Enrollment requests are signed by the requesting agent key. Approval records
+signed keychain operations for the new device/node/agent binding and signed auth
+operations for requested resource capabilities. `geth node enroll sync` pulls
+both signed logs from the owner node.
+
 `geth keychain sync <node>` pulls signed keychain operations from an imported
 peer over Iroh and rejects operations that do not have a valid OpenSSH signature
 from a currently trusted admin key over the canonical keychain payload. This is