Add owner-rooted node management

docs/roadmap.md

@@ -182,8 +182,12 @@ resource-scoped capability decisions.
   - `[x]` Tests cover signed keychain init with a generated local OpenSSH key
     when `ssh-keygen` is available.
   - `[x]` Tests cover local OpenSSH verification of stored keychain signatures.
-  - `[ ]` Future completion verifies signatures before accepting replicated
-    keychain ops.
+  - `[x]` `geth init --admin-key --signing-key --node-name` records signed
+    owner/user/device/node/agent binding operations.
+  - `[x]` `geth node list/rename/revoke` operate on the reduced keychain view.
+  - `[x]` `geth node rename/revoke` require an admin signing key.
+  - `[x]` `geth keychain sync <node>` verifies signatures from currently
+    trusted admin keys before accepting keychain ops.
 
 - `[x]` Keychain operation reducer.
   Acceptance criteria:
@@ -192,6 +196,17 @@ resource-scoped capability decisions.
   - Revoked keys/devices/nodes are excluded from active views.
   - Tests cover add, rename, revoke, and endpoint rotation.
 
+- `[~]` Node capability management.
+  Acceptance criteria:
+  - `[x]` `geth node grant <node> <resource> <capability>` records a
+    resource-scoped capability grant for a known node.
+  - `[x]` `geth node revoke-grant <resource> <grant-id>` records grant
+    revocation.
+  - `[x]` Node names can be used for management commands where the keychain view
+    has a unique active node name.
+  - `[ ]` Future completion signs auth ops and verifies signed auth ops before
+    accepting replicated permission changes.
+
 - `[x]` Resource auth operation reducer.
   Acceptance criteria:
   - Resource create, authority set, grants, revocations, and groups reduce into