autonomy attestation

Inspect runtime attestation state (enrollment + rollout)

Synopsis

Operator-facing observability for the runtime attestation gate.

The gate (#725 PR6) binds bundle provenance to per-node enrollment and
rollout state.  These subcommands let operators query the join state
without restarting the runtime.

Both subcommands consult the orchestrator's read APIs:
  GET /v1/enrollment/{node_id}    — enrollment record
  GET /v1/rollout/node/{node_id}  — current rollout state

Authentication and authorization follow the same mTLS / RBAC contract
as other paid-tier commands.

Subcommands