feat(P01): unified namespace root via ORCA_HOME + --system flag

REQ-041: ORCA_HOME is now the single namespace root for all components
  (db, certs, init, daemon). store.Open("") and init command both
  route through certpaths.Dir()/DBPath() instead of hardcoding ~/.orca.
  Backward compatible: empty ORCA_HOME -> ~/.orca.

REQ-042: --system persistent flag on rootCmd sets ORCA_HOME=/root/.orca
  via PersistentPreRunE. Errors on conflict with pre-set ORCA_HOME.

Tests: 7 new tests in namespace_test.go (default, ORCA_HOME override,
  --system sets root, conflict detection, init --json, flag registered).
  Full suite passes (no regressions).

Docs: docs/namespace.md covers default, ORCA_HOME, --system, ORCA_DB,
  resolution order, and path layout tables.

---ci---
project: orca
phase: 1
milestone: v0.5
status: verify
---/ci---

internal/cli/init.go

@@ -3,21 +3,18 @@ package cli
 import (
 	"fmt"
 	"os"
-	"path/filepath"
 
 	"github.com/spf13/cobra"
+
+	"git.cloudinit.dev/coreci/orca/internal/certpaths"
 )
 
 var initCmd = &cobra.Command{
 	Use:   "init",
 	Short: "Initialize local orca state directory",
-	Long:  "Create the local orca state directory at ~/.orca/ and write a default config file.",
+	Long:  "Create the local orca state directory (honors $ORCA_HOME; defaults to ~/.orca) and write a default config file.",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		home, err := os.UserHomeDir()
-		if err != nil {
-			return fmt.Errorf("get home dir: %w", err)
-		}
-		orcaDir := filepath.Join(home, ".orca")
+		orcaDir := certpaths.Dir()
 		if err := os.MkdirAll(orcaDir, 0o755); err != nil {
 			return fmt.Errorf("create orca dir: %w", err)
 		}

internal/cli/namespace_test.go

@@ -0,0 +1,120 @@
+package cli
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.cloudinit.dev/coreci/orca/internal/certpaths"
+)
+
+func resetRootFlags(t *testing.T) {
+	t.Helper()
+	rootCmd.SetArgs(nil)
+	var buf bytes.Buffer
+	rootCmd.SetOut(&buf)
+	rootCmd.SetErr(&buf)
+	_ = rootCmd.PersistentFlags().Set("system", "false")
+	_ = rootCmd.PersistentFlags().Set("json", "false")
+}
+
+func TestNamespaceDefaultsToUserHome(t *testing.T) {
+	t.Setenv("ORCA_HOME", "")
+	home, err := os.UserHomeDir()
+	if err != nil {
+		t.Fatalf("UserHomeDir: %v", err)
+	}
+	want := filepath.Join(home, ".orca")
+	if got := certpaths.Dir(); got != want {
+		t.Errorf("certpaths.Dir() = %q, want %q", got, want)
+	}
+}
+
+func TestNamespaceHonorsORCAHOME(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("ORCA_HOME", tmp)
+	if got := certpaths.Dir(); got != tmp {
+		t.Errorf("certpaths.Dir() = %q, want %q", got, tmp)
+	}
+	if got := certpaths.DBPath(); got != filepath.Join(tmp, "orca.db") {
+		t.Errorf("certpaths.DBPath() = %q, want %q", got, filepath.Join(tmp, "orca.db"))
+	}
+}
+
+func TestInitHonorsORCAHOME(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("ORCA_HOME", tmp)
+	resetRootFlags(t)
+
+	rootCmd.SetArgs([]string{"init"})
+	if err := rootCmd.Execute(); err != nil {
+		t.Fatalf("init: %v", err)
+	}
+
+	info, err := os.Stat(tmp)
+	if err != nil {
+		t.Fatalf("stat %s: %v", tmp, err)
+	}
+	if !info.IsDir() {
+		t.Errorf("%s is not a directory", tmp)
+	}
+}
+
+func TestSystemFlagSetsORCAHOME(t *testing.T) {
+	t.Setenv("ORCA_HOME", "")
+	resetRootFlags(t)
+
+	rootCmd.SetArgs([]string{"--system", "init"})
+	if err := rootCmd.Execute(); err != nil {
+		t.Fatalf("--system init: %v", err)
+	}
+	if got := os.Getenv("ORCA_HOME"); got != systemNamespaceRoot {
+		t.Errorf("ORCA_HOME = %q, want %q", got, systemNamespaceRoot)
+	}
+}
+
+func TestSystemFlagConflictsWithORCAHOME(t *testing.T) {
+	t.Setenv("ORCA_HOME", "/custom/path")
+	resetRootFlags(t)
+
+	rootCmd.SetArgs([]string{"--system", "init"})
+	err := rootCmd.Execute()
+	if err == nil {
+		t.Fatal("expected error for --system + ORCA_HOME conflict, got nil")
+	}
+}
+
+func TestInitJSONOutput(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("ORCA_HOME", tmp)
+	resetRootFlags(t)
+
+	var buf bytes.Buffer
+	rootCmd.SetOut(&buf)
+	rootCmd.SetArgs([]string{"init", "--json"})
+	if err := rootCmd.Execute(); err != nil {
+		t.Fatalf("init --json: %v", err)
+	}
+
+	var result map[string]string
+	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
+		t.Fatalf("unmarshal init output: %v\noutput: %s", err, buf.String())
+	}
+	if result["path"] != tmp {
+		t.Errorf("init --json path = %q, want %q", result["path"], tmp)
+	}
+	if result["status"] != "initialized" {
+		t.Errorf("init --json status = %q, want %q", result["status"], "initialized")
+	}
+}
+
+func TestSystemFlagIsPersistent(t *testing.T) {
+	for _, name := range []string{"system", "json"} {
+		f := rootCmd.PersistentFlags().Lookup(name)
+		if f == nil {
+			t.Errorf("persistent flag %q not found", name)
+		}
+	}
+}

internal/cli/root.go

@@ -3,6 +3,7 @@ package cli
 import (
 	"encoding/json"
 	"fmt"
+	"os"
 
 	"github.com/spf13/cobra"
 )
@@ -13,6 +14,8 @@ var (
 	buildTime = "unknown"
 )
 
+const systemNamespaceRoot = "/root/.orca"
+
 var rootCmd = &cobra.Command{
 	Use:   "orca",
 	Short: "Orca — offline/CLI-first orchestration engine",
@@ -21,12 +24,27 @@ inspired by HashiCorp Nomad, prioritizing stability, security, and simplicity
 over feature richness.`,
 	SilenceUsage:  true,
 	SilenceErrors: true,
+	PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+		if systemNamespace {
+			if existing := os.Getenv("ORCA_HOME"); existing != "" && existing != systemNamespaceRoot {
+				return fmt.Errorf("--system conflicts with ORCA_HOME=%q (already set); unset ORCA_HOME or drop --system", existing)
+			}
+			if err := os.Setenv("ORCA_HOME", systemNamespaceRoot); err != nil {
+				return fmt.Errorf("set ORCA_HOME for --system: %w", err)
+			}
+		}
+		return nil
+	},
 }
 
-var jsonOutput bool
+var (
+	jsonOutput      bool
+	systemNamespace bool
+)
 
 func init() {
 	rootCmd.PersistentFlags().BoolVar(&jsonOutput, "json", false, "output in JSON format")
+	rootCmd.PersistentFlags().BoolVar(&systemNamespace, "system", false, "use system-level namespace root (/root/.orca) instead of user-level (~/.orca)")
 }
 
 func Execute() error {