add linked sshsigchain v2 core

docs/roadmap.md

@@ -555,6 +555,24 @@ resource-scoped capability decisions.
   - JSON is not used as the signed representation.
   - Tests verify equivalent operations hash/sign identically across runs.
 
+- `[~]` Replace the legacy static keychain sigchain with SSHSIGCHAIN v2.
+  Acceptance criteria:
+  - `[x]` Publish a transport-neutral, deterministic SSHSIGCHAIN v2 record
+    format with explicit trust-anchor, chain-link, size-limit, and
+    non-claim documentation.
+  - `[x]` Provide a reusable verifier core and a geth keychain profile that
+    rejects self-bootstrap, non-linked forks, non-canonical payloads, and
+    post-revocation timestamp replay.
+  - `[ ]` Add explicit CLI storage, signing, verification, publication, and
+    import workflows for a pinned v2 trust tuple.
+  - `[ ]` Persist accepted v2 heads and require proof of extension before a
+    static source can advance.
+  - `[ ]` Disable the legacy static publish/fetch/import workflow by default
+    and provide an operator-visible migration path that creates a fresh v2
+    genesis chain.
+  - `[ ]` Add OpenSSH integration tests and independently generated wire test
+    vectors for the published standard.
+
 - `[x]` SSH-admin-rooted keychain initialization.
   Acceptance criteria:
   - `[x]` `geth keychain init` records a local `KeychainInit`.