Wire keychain status to local keychain ops

AGENTS.md

@@ -114,6 +114,8 @@ Roadmap items should be actionable and checkable:
   groups, and bearer access. The daemon persists local auth grant/revoke ops
   and uses them for `auth explain`. Signature validation and daemon-side module
   enforcement are still roadmap work.
+- The daemon persists local keychain init/admin-key ops and reduces them for
+  `keychain status`. SSH signature capture/verification is still roadmap work.
 - Signed peer-card LAN discovery payloads, peer auth over Iroh, cr-sqlite,
   iroh-docs, iroh-gossip, iroh-blobs, Automerge sync, real auth enforcement,
   OpenSSH KRL generation, and Keyhive/BeeKEM-style authorization are future