Add offline resource capability discovery

docs/roadmap.md

@@ -132,6 +132,16 @@ For deployment-readiness work that cuts across feature areas, see
   - `[x]` Tests and automation documentation define the single-document and
     line-oriented contracts.
 
+- `[x]` Make resource and capability vocabulary discoverable offline.
+  Acceptance criteria:
+  - `[x]` `geth resource capabilities [family]` lists exact resource ID
+    patterns, capability strings, and important operations or host effects.
+  - `[x]` Discovery works before initialization and without a running daemon,
+    and explicitly states that viewing the catalog does not grant access.
+  - `[x]` Human, JSON, and JSONL forms include a copy-paste grant template.
+  - `[x]` Tests cover the full catalog, family filtering, common aliases, and
+    unknown-family recovery.
+
 - `[ ]` Publish copy-paste installation entrypoints for release artifacts.
   Acceptance criteria:
   - `[ ]` Linux, macOS, and Windows installation instructions verify artifact

docs/user-workflows.md

@@ -172,6 +172,7 @@ authorized node fetch it over Iroh.
 On the provider:
 
 ```sh
+geth resource capabilities cas
 geth cas add ./archive.tar
 geth node grant workstation resource:cas:local cas.fetch \
   --signing-key ~/.ssh/id_ed25519_sk
@@ -197,6 +198,7 @@ building transport, peer authentication, and retry handling myself.
 Start locally with one of:
 
 ```sh
+geth resource capabilities kv
 geth kv create preferences
 geth kv set preferences theme dark
 
@@ -215,6 +217,10 @@ per-peer/per-stream cursors and retry state. File-root application is
 conservative: it does not overwrite local edits, and ambiguous changes become
 durable conflicts for `geth cas conflict list`.
 
+`geth resource capabilities [family]` is an offline catalog of exact resource
+ID patterns, grant capability strings, and operations or host effects. It does
+not require a running daemon and discovery does not create a grant.
+
 ## Automate Reliably
 
 User story: as an automation author, I want explicit homes, readiness checks,