feat(P09): dispatcher, transport.dispatch, CLI surface, daemon mount

Wave B of P02. Wires the data + engine + transport layers into the
daemon HTTP surface and the CLI.

- internal/engine/executor.go — adds Submit(specBytes) and
  Status(jobID) entry points to satisfy engine.LocalExecutor
  (used by the dispatcher). Submit parses a minimal JSON wire
  spec with name/command/args/env fields; Status reads from
  store.JobRepo and returns the stringified model.JobStatus.
- internal/engine/dispatcher.go — Dispatcher struct with
  LocalExecutor + capacity repo + peer registry + idempotency
  dedupe store. Submit(target, spec, idempotencyKey) does the
  local-fit-check then bin-packing pick; if no local capacity
  and target is empty, falls through to a peer. dispatchTo /
  dispatchToPeer open mTLS clients (no cert presented by the
  client in P02; the server uses RequireAndVerifyClientCert
  but P02 ships with the cert-pool wiring without enforcing
  client certs on the dispatch endpoint — P03 hardening).
  LocalSubmit/LocalStatus satisfy transport.Dispatcher.
- internal/transport/dispatch.go — SubmitHandler and
  StatusHandler (http.Handler). SubmitHandler honors
  X-Orca-Idempotency-Key for dedupe replay. Submit/Status
  Request/Response wire structs. DispatchClient wraps
  mTLS HTTP client with the retry loop. The retry Submit
  is implemented as a direct loop (not via Do[T]) because
  the response-decode path doesn't fit the generic shape
  cleanly.
- internal/daemon/dispatch_handler.go — DispatchHandlers
  groups Submit+Status; Mount(mux) attaches both routes.
- internal/daemon/server.go — Server gets a dispatch field;
  RegisterDispatch(h) attaches the handlers; mux() mounts
  them at /orca.v1.Dispatch/{Submit,Status}.
- internal/daemon/dispatch_test.go — round-trip, idempotency
  dedupe, and validation (empty spec=400, GET=405) coverage.
- internal/cli/daemon.go — wires the dispatch service into
  the daemon: executor + peer registry + dispatcher +
  RegisterDispatch. Adds /orca.v1.Dispatch/* to the startup
  banner.
- internal/cli/job.go — adds --target and --idempotency-key
  to 'orca job run'; routes through the dispatcher when set.
- internal/cli/node_capacity.go — 'orca node capacity
  {show,set,list}' for REQ-028. --set takes --cpu, --memory,
  --disk, --node. Positivity check on all three numerics.

All tests pass with -race; gofmt -l . clean; go vet ./...
clean. P02 verification commit follows.

---ci---
project: orca
phase: 9
milestone: v0.2
status: execute
---/ci---

internal/cli/daemon.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"os"
 	"os/signal"
@@ -13,6 +14,8 @@ import (
 	"github.com/spf13/cobra"
 
 	"git.cloudinit.dev/coreci/orca/internal/daemon"
+	"git.cloudinit.dev/coreci/orca/internal/engine"
+	"git.cloudinit.dev/coreci/orca/internal/store"
 )
 
 var (
@@ -22,7 +25,7 @@ var (
 var daemonCmd = &cobra.Command{
 	Use:   "daemon",
 	Short: "Run the orca daemon (HTTP API + health checks)",
-	Long:  "Start the orca daemon. Listens on the configured address for health and API requests.",
+	Long:  "Start the orca daemon. Listens on the configured address for health, API, and dispatch requests.",
 	RunE: func(cmd *cobra.Command, args []string) error {
 		db, closer, err := openDB()
 		if err != nil {
@@ -30,12 +33,21 @@ var daemonCmd = &cobra.Command{
 		}
 		defer closer()
 
+		log := newLogger()
 		srv := daemon.NewServer(daemon.Options{
 			DB:    db,
-			Log:   newLogger(),
+			Log:   log,
 			Addr:  daemonAddr,
 			Actor: "daemon",
 		})
+
+		// Wire the orca.v1.Dispatch service (v0.2 P02). The executor
+		// runs jobs locally; the dispatcher decides local vs peer.
+		executor := engine.NewExecutor(store.NewJobRepo(db), store.NewTaskRepo(db), log)
+		peers := engine.NewPeerRegistry()
+		dispatcher := engine.NewDispatcher(log, store.NewCapacityRepo(db), peers, executor)
+		srv.RegisterDispatch(daemon.NewDispatchHandlers(dispatcher, dispatcher.Dedupe()))
+
 		srv.MarkReady()
 
 		errCh := make(chan error, 1)
@@ -47,12 +59,14 @@ var daemonCmd = &cobra.Command{
 		}()
 
 		fmt.Fprintf(cmd.OutOrStdout(), "✓ orca daemon listening on %s\n", daemonAddr)
-		fmt.Fprintln(cmd.OutOrStdout(), "  /healthz    - liveness")
-		fmt.Fprintln(cmd.OutOrStdout(), "  /readyz     - readiness (db + ready flag)")
-		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/status  - status JSON")
-		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/jobs    - list jobs")
-		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/nodes   - list nodes")
-		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/tasks   - list tasks")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /healthz                        - liveness")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /readyz                         - readiness (db + ready flag)")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/status                      - status JSON")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/jobs                        - list jobs")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/nodes                       - list nodes")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/tasks                       - list tasks")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /orca.v1.Dispatch/Submit        - cross-node job submit (P02)")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /orca.v1.Dispatch/Status        - cross-node job status (P02)")
 		fmt.Fprintln(cmd.OutOrStdout(), "  press Ctrl+C to stop")
 
 		ctx, stop := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
@@ -73,4 +87,5 @@ var daemonCmd = &cobra.Command{
 func init() {
 	daemonCmd.Flags().StringVar(&daemonAddr, "addr", ":8080", "listen address")
 	rootCmd.AddCommand(daemonCmd)
+	_ = slog.Default // keep import if unused above
 }