Add guided node enrollment

docs/architecture.md

@@ -473,7 +473,11 @@ sigchain design. This is currently a pull-based signed operation log, not a
 CRDT or Keyhive-style convergent authority.
 
 New devices can use the node enrollment flow instead of hand-editing keychain
-state. `geth node enroll request` creates a canonical, agent-key-signed request
+state. `geth node enroll join` explicitly imports an owner admin public key as
+the new node's trust anchor, imports the signed peer card only as untrusted
+candidate routing metadata, creates the request, and submits it over Iroh. It
+does not grant trust to the peer card or approve the requesting node. The lower
+level `geth node enroll request` creates a canonical, agent-key-signed request
 containing the requesting node ID, agent ID, requested node name, optional Iroh
 endpoint, and requested resource capabilities. The request can be submitted over
 Iroh to an imported owner peer or moved as a JSON file to the owner machine.

docs/roadmap.md

@@ -597,6 +597,9 @@ resource-scoped capability decisions.
     cursors instead of blindly re-requesting the full log on every tick.
   - `[x]` `geth node enroll request` creates an agent-key-signed enrollment
     request with requested node name and capabilities.
+  - `[x]` `geth node enroll join` combines explicit admin-key trust bootstrap,
+    candidate-only peer-card import, request creation, and Iroh submission while
+    leaving owner approval as a separate admin-signed step.
   - `[x]` `geth node enroll submit/import/list` moves pending enrollment
     requests over Iroh or JSON file for owner review.
   - `[x]` `geth node enroll approve --signing-key` records signed keychain ops

docs/user-workflows.md

@@ -129,14 +129,15 @@ discovery or a peer card as proof of trust.
    geth peer export --out owner.peer.json
    ```
 
-2. On the new node, initialize, import the card, and submit a request:
+2. Transfer the owner's OpenSSH admin public key over a trusted channel. On the
+   new node, initialize and run the guided join:
 
    ```sh
    geth init
    geth daemon install
-   geth peer import owner.peer.json
-   geth node enroll request --node-name workstation --out workstation.enroll.json
-   geth node enroll submit owner-laptop --path workstation.enroll.json
+   geth node enroll join owner.peer.json \
+     --admin-key owner-admin.pub \
+     --node-name workstation
    ```
 
 3. On the owner node, review and approve with the admin key:
@@ -149,13 +150,19 @@ discovery or a peer card as proof of trust.
 4. On the new node, pull and inspect the approved state:
 
    ```sh
-   geth sync now owner-laptop
-   geth wait sync owner-laptop
+   geth node enroll sync <owner-node-id>
+   geth wait sync <owner-node-id>
    geth node list
    ```
 
-Peer-card import only supplies signed endpoint metadata. The owner-signed
-keychain and authorization operations are what create trust and capabilities.
+The explicit admin public key bootstraps the trust anchor needed to verify the
+later approval sync; verify that key through a separate trusted channel. The
+peer card only supplies signed candidate endpoint metadata. `join` combines
+peer import, request creation, and submission, but cannot approve itself. The
+owner-signed keychain and authorization operations are what create the device
+binding and capabilities. The lower-level `peer import` and `node enroll
+request|submit|import` commands remain available for offline handoff and
+recovery.
 
 ## Move A Blob Between Nodes