Substrate

[aojea]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces binary-level capability roles (sam:role:node, sam:role:sambox, and sam:role:router) to enforce the principle of least privilege during client enrollment and startup. The EnrollRequest and BootstrapEnrollRequest protobuf messages have been updated to include a requested_role field, and the control plane now validates that the client is authorized for the requested role before minting the Biscuit token. Additionally, nano-init has been refactored to support explicit copy and run subcommands. Feedback on these changes includes addressing a potential silent write failure in copyFile by checking the destination file's Close() error, and resolving a duplicate role bug in MintBiscuitToken when the requested role is a custom access role.