make sshsigchain the only portable sigchain format

docs/command-stability.md

@@ -33,7 +33,7 @@ The following command families are intended to be stable automation surfaces:
 - `geth peer export|import|list|ping|auth-check`
 - `geth keychain init|status|admin-add|admin-revoke|allowed-signers|verify`
 - `geth keychain sign-file|verify-file`
-- `geth keychain sigchain|verify-sigchain|import-sigchain|verify-checkpoint|fetch|explain|explain-signer`
+- `geth keychain explain|explain-signer`
 - `geth auth explain|grant|revoke|sync`
 - `geth sync status|now`
 - `geth wait daemon|peer|sync`
@@ -61,6 +61,7 @@ settles:
 - `geth overlay status|plan|join|leave|interface-plan|up|down|peers|send|recv`
 - `geth cas add-private`
 - `geth cas get-private`
+- `geth keychain verify-sigchain`
 
 Migration expectation: overlay membership records and authorization resources
 should remain readable, but packet runtime flags, platform activation details,
@@ -71,6 +72,11 @@ properties are explicitly out of scope. Prototype BLAKE3-XOR envelopes from
 earlier pre-deployment builds are rejected with a clear error and should be
 recreated from plaintext.
 
+The SSHSIGCHAIN verifier is experimental while SSHSIGCHAIN signing, storage,
+publication, import, head persistence, and independently generated wire vectors
+are completed. The prior test-only static commands were removed and are not a
+compatibility path.
+
 ## Adding Commands
 
 New commands should enter this file in the same change that introduces the CLI