Add canonical signed operation envelopes

AGENTS.md

@@ -107,6 +107,8 @@ Roadmap items should be actionable and checkable:
   pinned `geth-iroh` endpoint wrapper with protocol-router scaffold, peer-card
   types, untrusted discovery-backend trait, custom relay-map config, and Iroh
   local-network discovery toggle exist.
+- Canonical signed-operation envelopes exist for keychain/auth signature
+  payloads. Reducers and enforcement remain separate roadmap work.
 - Signed peer-card LAN discovery payloads, peer auth over Iroh, cr-sqlite,
   iroh-docs, iroh-gossip, iroh-blobs, Automerge sync, real auth enforcement,
   OpenSSH KRL generation, and Keyhive/BeeKEM-style authorization are future