Add sync health and explicit sync trigger

docs/roadmap.md

@@ -150,7 +150,12 @@ geth-to-geth connections without granting trust from discovery alone.
     the relevant resource capability.
   - `[x]` Background live-sync skips per-module pulls when the authorized remote
     watermark has not advanced.
+  - `[x]` `geth sync status` reports last local attempt, success, cursor,
+    import/rejection counts, and error for each recorded peer stream.
+  - `[x]` `geth sync now [node]` triggers the same best-effort sync pass that
+    background live sync uses.
   - `[x]` Tests verify unauthorized streams are omitted from summary output.
+  - `[x]` Tests verify persisted stream health is exposed in local sync status.
 
 ## Phase 2: Trust And Authorization
 
@@ -188,6 +193,8 @@ resource-scoped capability decisions.
   - `[x]` `geth node rename/revoke` require an admin signing key.
   - `[x]` `geth keychain sync <node>` verifies signatures from currently
     trusted admin keys before accepting keychain ops.
+  - `[x]` Keychain live sync advertises and consumes per-peer high-water
+    cursors instead of blindly re-requesting the full log on every tick.
   - `[x]` `geth node enroll request` creates an agent-key-signed enrollment
     request with requested node name and capabilities.
   - `[x]` `geth node enroll submit/import/list` moves pending enrollment
@@ -217,6 +224,8 @@ resource-scoped capability decisions.
   - `[x]` Enrollment approval signs capability grants as auth ops.
   - `[x]` `geth auth sync <node>` imports only auth ops signed by currently
     trusted admin keys.
+  - `[x]` Auth live sync advertises and consumes per-peer high-water cursors
+    instead of blindly re-requesting the full log on every tick.
   - `[x]` `geth auth grant/revoke --signing-key` records signed auth ops.
 
 - `[x]` Resource auth operation reducer.