Add overlay planning commands

docs/roadmap.md

@@ -135,6 +135,9 @@ Implementation order:
   - `[x]` CLI errors for stale peer cards, missing endpoint bindings, missing
     grants, unavailable relays, unavailable service managers, and unsupported
     platform features tell the operator what command to run next.
+  - `[x]` `geth init --help` and `geth guide <topic>` explain owner setup,
+    enrollment, key roles, service installation, and smoke-test workflows from
+    the binary itself.
   - `[x]` `geth sync status --json` is sufficient for scripts to detect stale
     peers and failed streams.
 
@@ -572,6 +575,29 @@ Goal: add authorized stream-oriented management workflows over Iroh.
     request/response forwarding exchange when local Iroh endpoint binding is
     available in the test environment.
 
+- `[~]` Optional Iroh overlay network.
+  Acceptance criteria:
+  - `[x]` Add a focused `geth-overlay` crate for overlay names, CIDRs,
+    resource IDs, capabilities, status, and plan models.
+  - `[x]` Reserve `/geth/overlay/1` in the daemon-owned Iroh protocol router.
+  - `[x]` Add `overlay` as a resource kind and document capabilities:
+    `overlay.join`, `overlay.route`, and `overlay.admin`.
+  - `[x]` Add CLI/control commands for `geth overlay status`, `plan`, `join`,
+    and `leave`.
+  - `[x]` Prototype commands make clear that no TUN/Wintun interface is created
+    and no packets are routed yet.
+  - `[x]` Tests cover overlay validation and control serialization.
+  - `[ ]` Persist overlay network configuration and membership state as
+    resource metadata.
+  - `[ ]` Implement resource-authorized overlay join using resource secrets
+    without granting node identity.
+  - `[ ]` Add platform-specific, opt-in TUN/Wintun interface management with
+    generated-definition tests and no privileged test requirements.
+  - `[ ]` Route IPv4 packets over `/geth/overlay/1` using the shared daemon
+    Iroh endpoint.
+  - `[ ]` Add live peer/IP coordination over trusted resource metadata and
+    untrusted discovery candidates.
+
 - `[~]` Unix socket forwarding where supported.
   Acceptance criteria:
   - `[x]` Unix socket forwarding is available on Unix platforms through