feat(P02): ACL — SPIFFE + token identities, deny-by-default

internal/acl/acl.go: Identity, Permission, ACLEntry, ACL with
Grant/Revoke/Check/List; SpiffeNamespace extraction; deny-by-default.
internal/cli/acl.go: orca acl grant/revoke/list/check CLI;
state at cluster/acl.json. Tests: grant/revoke/deny/ns-isolation/concurrent.

---ci---
project: orca
phase: 02
milestone: v0.11
status: execute
---/ci---

internal/paths/paths.go

@@ -119,3 +119,7 @@ func ConfigPath() string { return filepath.Join(ClusterDir(), "config.md") }
 // LegacyHCLConfigPath returns the legacy HCL config path:
 // ClusterDir()/config.hcl.
 func LegacyHCLConfigPath() string { return filepath.Join(ClusterDir(), "config.hcl") }
+
+// ACLPath returns the cluster-wide ACL state file (P02, v0.11):
+// ClusterDir()/acl.json. A simple JSON file — no DB needed for v0.11.
+func ACLPath() string { return filepath.Join(ClusterDir(), "acl.json") }