Add guided node enrollment

docs/user-workflows.md

@@ -129,14 +129,15 @@ discovery or a peer card as proof of trust.
    geth peer export --out owner.peer.json
    ```
 
-2. On the new node, initialize, import the card, and submit a request:
+2. Transfer the owner's OpenSSH admin public key over a trusted channel. On the
+   new node, initialize and run the guided join:
 
    ```sh
    geth init
    geth daemon install
-   geth peer import owner.peer.json
-   geth node enroll request --node-name workstation --out workstation.enroll.json
-   geth node enroll submit owner-laptop --path workstation.enroll.json
+   geth node enroll join owner.peer.json \
+     --admin-key owner-admin.pub \
+     --node-name workstation
    ```
 
 3. On the owner node, review and approve with the admin key:
@@ -149,13 +150,19 @@ discovery or a peer card as proof of trust.
 4. On the new node, pull and inspect the approved state:
 
    ```sh
-   geth sync now owner-laptop
-   geth wait sync owner-laptop
+   geth node enroll sync <owner-node-id>
+   geth wait sync <owner-node-id>
    geth node list
    ```
 
-Peer-card import only supplies signed endpoint metadata. The owner-signed
-keychain and authorization operations are what create trust and capabilities.
+The explicit admin public key bootstraps the trust anchor needed to verify the
+later approval sync; verify that key through a separate trusted channel. The
+peer card only supplies signed candidate endpoint metadata. `join` combines
+peer import, request creation, and submission, but cannot approve itself. The
+owner-signed keychain and authorization operations are what create the device
+binding and capabilities. The lower-level `peer import` and `node enroll
+request|submit|import` commands remain available for offline handoff and
+recovery.
 
 ## Move A Blob Between Nodes