Live sync SSH metadata in background

AGENTS.md

@@ -108,7 +108,8 @@ Roadmap items should be actionable and checkable:
   types, manual signed peer-card export/import/list commands, `geth peer ping`
   and `geth peer auth-check` over Iroh, signed peer-card LAN discovery payloads,
   authorized `geth cas fetch`, `geth ssh cert sync`, and
-  `geth ssh revocation sync` over the Iroh control ALPN, untrusted
+  `geth ssh revocation sync` over the Iroh control ALPN, a background SSH
+  metadata live-sync loop with per-peer cursors in `module_state`, untrusted
   discovery-backend trait, custom relay-map config, and Iroh local-network
   discovery toggle exist.
 - Canonical signed-operation envelopes exist for keychain/auth signature
@@ -160,7 +161,8 @@ Roadmap items should be actionable and checkable:
   public-key and certificate binary KRL revocations when `ssh-keygen` is
   available. Authorized peers can pull SSH certificate-flow metadata with
   `ssh_cert.sync` on `resource:ssh:certs` and revocation metadata with
-  `ssh_revocation.sync` on `resource:ssh:revocations`; this is pull-only
+  `ssh_revocation.sync` on `resource:ssh:revocations`. The daemon live-syncs
+  known peers every 30 seconds using per-peer cursors; this is pull-only
   metadata sync, not yet a CRDT/resource-log replication model.
 - cr-sqlite, iroh-docs, iroh-blobs provider/fetch, Automerge sync, broader auth
   enforcement, and Keyhive/BeeKEM-style authorization are future roadmap items