feat: add backup restore workflow

docs/command-stability.md

@@ -24,6 +24,7 @@ The following command families are intended to be stable automation surfaces:
 - `geth daemon service install|uninstall|start|stop|status|print`
 - `geth status`
 - `geth node id`
+- `geth backup create|restore`
 - `geth node list|rename|revoke|grant|revoke-grant|endpoint-add|endpoint-revoke`
 - `geth node enroll request|submit|import|list|approve|sync`
 - `geth peer export|import|list|ping|auth-check`

docs/production-readiness-roadmap.md

@@ -134,13 +134,13 @@ it.
     error.
   - `[x]` Tests cover failure injection for at least one multi-table path.
 
-- `[ ]` Add backup and restore workflow.
+- `[x]` Add backup and restore workflow.
   Acceptance criteria:
-  - `[ ]` `geth backup create` or an equivalent documented command captures
+  - `[x]` `geth backup create` or an equivalent documented command captures
     metadata, identity public material, config, and CAS metadata expectations.
-  - `[ ]` Restore can write to a separate target home for validation.
-  - `[ ]` Backup output avoids copying private SSH admin keys.
-  - `[ ]` Docs explain what is and is not included.
+  - `[x]` Restore can write to a separate target home for validation.
+  - `[x]` Backup output avoids copying private SSH admin keys.
+  - `[x]` Docs explain what is and is not included.
 
 - `[x]` Document database durability settings.
   Acceptance criteria:
@@ -339,7 +339,7 @@ Goal: prove the system works as an actual base layer before broader use.
 1. `[x]` Finish Phase 0.
 2. `[~]` Refactor `geth-node` into daemon subsystems.
 3. `[x]` Add stable contract and golden JSON tests.
-4. `[ ]` Harden store migrations and backup.
+4. `[x]` Harden store migrations and backup.
 5. `[ ]` Complete security-boundary test coverage.
 6. `[ ]` Replace prototype private CAS cryptography.
 7. `[ ]` Add fault-injection sync tests.