fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

R-023: Zero-trust enforcement operationally wired.

ACL enforcement (C-45 staged rollout):
- acl.Check wired into all 5 daemon handlers (dispatch/jobs/nodes/tasks)
- health endpoints exempt (liveness probes not gated)
- ACL log-only mode default (config acl.enforce=false); enforce after
  bootstrap ACL verified
- sshpush auth: ORCA_OIDC_TOKEN validated against JWKS before apply
- txn apply: Authorize hook validates OIDC token before running pull
- acl.json mode 0600 (was 0644)
- flock on acl.json for concurrent grant/revoke
- bootstrap ACL: init grants cluster-admin to orca-admins group + SVID

Audit actor identity:
- currentActor reads OIDC sub from credentials.json (was hardcoded "cli")
- threaded through all audit.Record calls via context

WebAuthn registration auth:
- BeginRegistration/FinishRegistration require authenticated session
- fail-closed 401 when no authFunc configured

New files: internal/daemon/acl.go, internal/cli/authactor.go,
internal/engine/actor.go, internal/identity/authtoken.go,
internal/sshpush/auth.go, internal/txn/auth_test.go

---ci---
project: orca
phase: 4
milestone: v0.13
status: complete
requirements:
  covered: [153]
---/ci---

tests/security_integration_test.go

@@ -56,6 +56,44 @@ func TestSecurityInvariants_Metadata(t *testing.T) {
 	// F18: drift event auth. Tested by:
 	//   - internal/drift: TestVerifyEventSignature
 	//
+	// P04 (v0.13) ACL enforcement wiring (C-44/C-45):
+	//   - internal/daemon: TestACLPolicyDenyByDefault
+	//     (authenticated request with no ACL entry → deny in enforce mode)
+	//   - internal/daemon: TestACLPolicyAllowWithEntry
+	//     (authenticated request with matching ACL entry → allow)
+	//   - internal/daemon: TestACLPolicyUnauthenticatedEnforce
+	//     (unauthenticated request → 403 in enforce mode)
+	//   - internal/daemon: TestACLPolicyLogOnlyAllowsDenials (C-45)
+	//     (denials logged but allowed in log-only mode)
+	//   - internal/daemon: TestACLJobsHandlerEnforceDeniesUnauthenticated
+	//     (wired jobs handler denies unauthenticated in enforce mode)
+	//   - internal/daemon: TestACLJobsHandlerAllowsAuthenticatedWithEntry
+	//     (wired jobs handler allows authenticated with matching entry)
+	//   - internal/daemon: TestACLNodesHandlerEnforceDeniesUnauthenticated
+	//   - internal/daemon: TestACLTasksHandlerEnforceDeniesUnauthenticated
+	//   - internal/txn: Apply refuses when ORCA_OIDC_TOKEN is missing/invalid
+	//     (C-44: SSH-push applier + txn apply path validate OIDC token)
+	//   - internal/sshpush: AuthorizeApply validates ORCA_OIDC_TOKEN
+	//
+	// P04 (v0.13) WebAuthn registration auth (C-45, T9):
+	//   - internal/webauthn: TestConnectorBeginRegistrationUnauthenticated
+	//     (unauthenticated BeginRegistration → 401, fail-closed)
+	//   - internal/webauthn: TestConnectorFinishRegistrationUnauthenticated
+	//     (unauthenticated FinishRegistration → 401)
+	//
+	// P04 (v0.13) acl.json hardening (T6/T7):
+	//   - internal/cli: saveACL writes acl.json with mode 0600 (T6)
+	//   - internal/cli: lockACL flocks grant/revoke (T7, prevents races)
+	//
+	// P04 (v0.13) bootstrap ACL (T8, C-40):
+	//   - internal/cli: bootstrapACL grants cluster-admin to orca-admins
+	//     group + init SVID on `orca init` (prevents operator lockout)
+	//
+	// P04 (v0.13) audit actor identity (T5):
+	//   - internal/cli: currentActor reads OIDC sub from credentials.json
+	//   - internal/engine: ActorFromCtx threads sub into audit Record calls
+	//     (replaces hardcoded "cli" actor)
+	//
 	// This test is the gate (C-33): if it runs, the suite is wired.
-	t.Log("security integration test suite wired (R-021, F1-F25, REQ-119..148)")
+	t.Log("security integration test suite wired (R-021, F1-F25, REQ-119..148, P04 ACL enforcement C-44/C-45)")
 }