Add safe configuration commands

docs/roadmap.md

@@ -67,6 +67,17 @@ For deployment-readiness work that cuts across feature areas, see
   - `[x]` A recursive CLI test fails when a future argument is added without a
     description.
 
+- `[x]` Add a safe configuration workflow.
+  Acceptance criteria:
+  - `[x]` `geth config path/show/validate` identify the selected file, expose
+    built-in defaults when it is absent, and report parse or semantic errors.
+  - `[x]` `geth config set` supports the common Iroh and live-sync settings,
+    preserves unrelated TOML and comments, and validates before replacement.
+  - `[x]` Updates use a same-directory temporary file and clearly report that a
+    daemon restart is required.
+  - `[x]` Tests cover comment preservation, invalid-update rollback, and
+    creation from defaults in an isolated temporary home.
+
 - `[x]` Document task-oriented user stories.
   Acceptance criteria:
   - `[x]` Workflows cover disposable evaluation, persistent background use,

docs/user-workflows.md

@@ -67,6 +67,27 @@ Set `RUST_LOG=geth_node=debug` when more daemon diagnostics are useful. Use
 `geth --home <dir> ...` to operate an isolated home without exporting an
 environment variable.
 
+## Inspect And Change Configuration
+
+User story: as an operator, I want to find and validate the exact configuration
+used by one geth home without guessing an OS-specific path or hand-editing
+common boolean and interval settings.
+
+```sh
+geth config path
+geth config show
+geth config set sync.live_sync_interval_ms 10000
+geth config validate
+geth daemon stop
+geth daemon start
+```
+
+`config show` reports built-in defaults when the file has not been created yet.
+`config set` preserves unrelated TOML and comments and refuses to replace the
+file if the complete prospective configuration is invalid. Success means
+`config validate` identifies the selected path as valid. Configuration is
+loaded at daemon startup, so restart the user service after changes.
+
 ## Establish An Owner Trust Root
 
 User story: as the mesh owner, I want my first node rooted in an existing SSH