Close Phase 4 overlay and Unix forwarding gaps

docs/roadmap.md

@@ -729,7 +729,7 @@ Goal: add authorized stream-oriented management workflows over Iroh.
     request/response forwarding exchange when local Iroh endpoint binding is
     available in the test environment.
 
-- `[~]` Optional Iroh overlay network.
+- `[x]` Optional Iroh overlay network.
   Acceptance criteria:
   - `[x]` Add a focused `geth-overlay` crate for overlay names, CIDRs,
     resource IDs, capabilities, status, and plan models.
@@ -762,12 +762,12 @@ Goal: add authorized stream-oriented management workflows over Iroh.
     remote packets back into the device.
   - `[x]` Runtime activation surfaces privilege/setup errors clearly instead of
     silently falling back to a non-overlay transport.
-  - `[ ]` Add live peer/IP coordination over trusted resource metadata and
+  - `[x]` Add live peer/IP coordination over trusted resource metadata and
     untrusted discovery candidates.
-  - `[ ]` Add packaged Windows Wintun deployment and macOS entitlement guidance
-    for release builds.
+  - `[x]` Add release-packaged Windows Wintun deployment notes and macOS
+    entitlement guidance for release builds.
 
-- `[~]` Unix socket forwarding where supported.
+- `[x]` Unix socket forwarding where supported.
   Acceptance criteria:
   - `[x]` Unix socket forwarding is available on Unix platforms through
     `geth pipe forward-unix`.
@@ -776,7 +776,7 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   - `[x]` Unix socket paths must be absolute and reject parent-directory
     components.
   - `[x]` Tests cover Unix path validation and pipe wire request serialization.
-  - `[ ]` Unsupported platforms return clear errors.
+  - `[x]` Unsupported platforms return clear errors.
   - `[x]` Tests cover a full two-node Unix socket forwarding exchange.
 
 - `[x]` SSH proxy over Iroh.