Add owner-rooted node management

AGENTS.md

@@ -122,13 +122,16 @@ Roadmap items should be actionable and checkable:
   and uses them for `auth explain`. `kv set --subject <principal>` enforces
   local KV write grants for non-local test callers. Signature validation and
   broader daemon-side module enforcement are still roadmap work.
-- The daemon persists local keychain init/admin-key ops and reduces them for
-  `keychain status`. `keychain init --signing-key <path>` signs recorded
-  keychain ops with `ssh-keygen -Y sign` under the
-  `geth.keychain.v1@geth.local` namespace and stores signatures locally.
-  `keychain status` verifies stored signatures with OpenSSH when public key
-  material is available. Verification before accepting replicated keychain ops
-  is still roadmap work.
+- The daemon persists local keychain ops and reduces them for `keychain status`.
+  `geth init --admin-key <pub> --signing-key <key> --node-name <name>` records
+  signed owner/user/device/node/agent binding operations. `keychain
+  init --signing-key <path>` signs recorded keychain ops with `ssh-keygen -Y
+  sign` under the `geth.keychain.v1@geth.local` namespace and stores signatures
+  locally. `keychain status` verifies stored signatures with OpenSSH when public
+  key material is available. `geth keychain sync <node>` imports only keychain
+  ops with valid OpenSSH signatures from currently trusted admin keys. `geth
+  node list/rename/revoke/grant` are the current node-management surface over
+  that reduced keychain/auth view; rename and revoke require `--signing-key`.
 - Local CAS supports pin/unpin metadata, surfaced through `cas list`, and
   `cas cleanup` evicts unpinned blobs while retaining pinned blobs. The daemon
   can fetch CAS blobs from an imported signed peer card over Iroh when the peer