feat(P12): --type linux SSH-join + UAT plan + signoff script (REQ-161..163)

--type linux (REQ-161):
- internal/linux/bootstrap.go: SSH bootstrap for generic Linux workers
  (orcas pubkey, system user, drift-events dir; no PVE role/sudoers)
- internal/cli/node.go: joinLinux function + --type linux dispatch
- peer-setup kept as documented fallback

UAT plan (REQ-162):
- docs/uat.md: 3-host topology (lead Ubuntu + pve01 Proxmox + worker01
  Ubuntu), 22 step-by-step commands, 35-claim matrix, Proxmox
  prerequisite + alternative 3xUbuntu path (C-48), signoff procedure

UAT signoff script (REQ-163, C-47):
- scripts/uat-signoff.sh: 35 idempotent read-only assertions, exit 0
  iff all pass. Includes 4 critical-path assertions: job deploys to
  remote, ACL deny-by-default, seal/unseal round-trip, OIDC health
- scripts/uat-smoke.sh: 13 CI-tested pure-CLI assertions for .coreci.yml

Tests: node join --type linux test, fingerprint test updated, smoke
test all 13 pass.

---ci---
project: orca
phase: 12
milestone: v0.13
status: complete
requirements:
  covered: [161, 162, 163]
---/ci---

internal/cli/node_test.go

@@ -452,15 +452,15 @@ func TestNodeJoinHostKeyFingerprintRequiresProxmox(t *testing.T) {
 	rootCmd.SetErr(&buf)
 	rootCmd.SetArgs([]string{
 		"node", "join",
-		"--type", "linux",
-		"--name", "linux-node",
+		"--type", "localhost",
+		"--name", "localhost-node",
 		"--host-key-fingerprint", "SHA256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
 	})
 	err := rootCmd.Execute()
 	if err == nil {
 		t.Fatal("expected error for --host-key-fingerprint without --type proxmox, got nil")
 	}
-	if !strings.Contains(err.Error(), "--host-key-fingerprint requires --type proxmox") {
+	if !strings.Contains(err.Error(), "--host-key-fingerprint requires --type proxmox or --type linux") {
 		t.Errorf("error should mention the --host-key-fingerprint/--type proxmox requirement, got: %v", err)
 	}
 }