Add smooth node enrollment flow

docs/roadmap.md

@@ -188,6 +188,14 @@ resource-scoped capability decisions.
   - `[x]` `geth node rename/revoke` require an admin signing key.
   - `[x]` `geth keychain sync <node>` verifies signatures from currently
     trusted admin keys before accepting keychain ops.
+  - `[x]` `geth node enroll request` creates an agent-key-signed enrollment
+    request with requested node name and capabilities.
+  - `[x]` `geth node enroll submit/import/list` moves pending enrollment
+    requests over Iroh or JSON file for owner review.
+  - `[x]` `geth node enroll approve --signing-key` records signed keychain ops
+    for device/node/agent/endpoint enrollment.
+  - `[x]` `geth node enroll sync <owner-node>` pulls approved signed keychain
+    and auth state onto the requesting node.
 
 - `[x]` Keychain operation reducer.
   Acceptance criteria:
@@ -204,8 +212,11 @@ resource-scoped capability decisions.
     revocation.
   - `[x]` Node names can be used for management commands where the keychain view
     has a unique active node name.
-  - `[ ]` Future completion signs auth ops and verifies signed auth ops before
-    accepting replicated permission changes.
+  - `[x]` Enrollment approval signs capability grants as auth ops.
+  - `[x]` `geth auth sync <node>` imports only auth ops signed by currently
+    trusted admin keys.
+  - `[ ]` Future completion requires signed auth ops for every manual
+    grant/revoke command, not only enrollment approval and replicated imports.
 
 - `[x]` Resource auth operation reducer.
   Acceptance criteria: