Add OpenSSH KRL spec export

AGENTS.md

@@ -134,6 +134,8 @@ Roadmap items should be actionable and checkable:
   Bearer access metadata can be created/listed/revoked as resource-scoped auth
   ops and must not allow trust graph mutation capabilities. Payload encryption,
   key envelopes, and bearer challenge-response are still roadmap work.
+- SSH revocations can be exported as JSONL or OpenSSH KRL specification text.
+  Binary KRL generation/import is still roadmap work.
 - Signed peer-card LAN discovery payloads, peer auth over Iroh, cr-sqlite,
   iroh-docs, iroh-blobs, Automerge sync, real auth enforcement,
   OpenSSH KRL generation, and Keyhive/BeeKEM-style authorization are future