Test owner approved enrollment sync flow

README.md

@@ -385,7 +385,12 @@ geth node revoke work-laptop --signing-key ~/.ssh/id_ed25519_sk
 The enrollment flow for a new node is:
 
 ```sh
-# On the new node:
+# On the new node, initialize local state and trust the owner's admin public key:
+geth init
+geth daemon run
+geth keychain init --admin-key ~/.ssh/id_ed25519_sk.pub
+
+# Then create a signed enrollment request:
 geth node enroll request \
   --node-name workstation \
   --capability resource:ssh-proxy:local=ssh_proxy.connect \
@@ -400,13 +405,16 @@ geth node enroll list --status pending
 geth node enroll approve <request-id> --signing-key ~/.ssh/id_ed25519_sk
 
 # Back on the new node, pull signed identity and authorization state:
-geth node enroll sync owner-laptop
+geth sync now owner-laptop
+geth sync status
 ```
 
 Enrollment requests are signed by the requesting agent key. Approval records
 signed keychain operations for the new device/node/agent binding and signed auth
-operations for requested resource capabilities. `geth node enroll sync` pulls
-both signed logs from the owner node.
+operations for requested resource capabilities. The requesting node must already
+know the owner's admin public key so it can verify the signed operation logs
+before importing them. `geth sync now` pulls both signed logs from the owner
+node through the same path used by background live sync.
 
 `geth keychain sync <node>` pulls signed keychain operations from an imported
 peer over Iroh and rejects operations that do not have a valid OpenSSH signature