feat: add backup restore workflow

README.md

@@ -100,6 +100,8 @@ The bootstrap implementation provides:
 - `geth daemon service install|uninstall|start|stop|status|print`
 - `geth status`
 - `geth wait daemon|peer|sync --timeout-ms <ms>`
+- `geth backup create --out <dir>`
+- `geth backup restore <backup-dir> --target-home <dir>`
 - `geth node id`
 - `geth node list`
 - `geth node enroll request --node-name <name> --capability <resource=capability> [--out <path>]`
@@ -417,6 +419,21 @@ cargo run -p geth -- cas add /tmp/hello-geth.txt
 cargo run -p geth -- cas list
 ```
 
+## Backup And Restore
+
+`geth backup create --out <dir>` creates an offline directory backup with a
+`manifest.json` plus a `home/` payload. The backup includes `config.toml`,
+`geth.sqlite` and SQLite WAL sidecars when present, and local CAS blobs. It
+records public geth identity material in the manifest when available.
+
+The backup intentionally excludes daemon runtime files, private geth identity
+keys under `identity/*.ed25519`, and private SSH admin keys. SSH admin keys are
+external trust anchors; geth stores public admin material and signatures, not
+the private SSH keys.
+
+`geth backup restore <backup-dir> --target-home <dir>` restores into a separate
+empty target home for validation. It refuses to overwrite a non-empty target.
+
 ## Owner And Node Management
 
 The intended owner setup is SSH-admin-rooted: