Add guided node enrollment

docs/roadmap.md

@@ -597,6 +597,9 @@ resource-scoped capability decisions.
     cursors instead of blindly re-requesting the full log on every tick.
   - `[x]` `geth node enroll request` creates an agent-key-signed enrollment
     request with requested node name and capabilities.
+  - `[x]` `geth node enroll join` combines explicit admin-key trust bootstrap,
+    candidate-only peer-card import, request creation, and Iroh submission while
+    leaving owner approval as a separate admin-signed step.
   - `[x]` `geth node enroll submit/import/list` moves pending enrollment
     requests over Iroh or JSON file for owner review.
   - `[x]` `geth node enroll approve --signing-key` records signed keychain ops