autonomy attestation

Inspect runtime attestation state (enrollment + rollout)

Synopsis

Operator-facing observability for the runtime attestation gate.

The gate (#725 PR6) binds bundle provenance to per-node enrollment and
rollout state.  These subcommands let operators query the join state
without restarting the runtime.

Both subcommands consult the orchestrator's read APIs:
  GET /v1/enrollment/{node_id}    — enrollment record
  GET /v1/rollout/node/{node_id}  — current rollout state

Authentication and authorization follow the same mTLS / RBAC contract
as other paid-tier commands.

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

Subcommands