Trustees
Load the signed manifest.json and its
network-root.pin.json from steadctl gen-fleet.
The manifest fills the node URLs; an optional fleet.json
can override reachability after a cloud deployment.
Create a private vault
Encrypted to a recipient credential + custody. Only claimable after you go silent past the deadline.