test(P08): integration test harness + drift-detection stubs (REQ-087)

tests/integration/harness.go: temp ORCA_HOME + mock peers + helpers.
tests/integration/scenarios_test.go: ns-create/job-submit/drain/backup/
secrets/acl/metrics scenarios. drift_scenarios_test.go: 4 stubs (auto-
remediation, NFS, cooldown, secret exclusion) skip until P10b.
scripts/tests/orca-commands_test.bash: bats for new CLI commands.

---ci---
project: orca
phase: 08
milestone: v0.11
status: execute
---/ci---

scripts/tests/orca-commands_test.bash

@@ -0,0 +1,132 @@
+#!/usr/bin/env bats
+# Tests for the built orca binary's CLI surface (P08, REQ-087). Verifies
+# that the new commands shipped in P00-P07 (--help, version, cache show,
+# acl list, secrets list) work against the built binary so a packaging
+# regression (missing subcommand, broken flag parsing) surfaces in the
+# bash gate before a release ships.
+#
+# The binary is built by `make build` to bin/orca. These tests skip
+# gracefully if the binary is absent (e.g. a fresh checkout that has
+# not run make).
+
+load test_helper
+
+# ORCA_BIN resolves to the built binary at <repo>/bin/orca. SCRIPTS_DIR
+# is the scripts/ dir (set by test_helper), so the repo root is its
+# parent.
+ORCA_BIN="$SCRIPTS_DIR/../bin/orca"
+
+# skip_if_no_orca skips the test if the built binary is missing. This
+# keeps the bats gate green on a fresh checkout that has not run `make
+# build`; `make test` builds first, so CI always exercises these.
+skip_if_no_orca() {
+	if [ ! -x "$ORCA_BIN" ]; then
+		skip "bin/orca not built — run 'make build' (skipping CLI tests)"
+	fi
+}
+
+@test "orca --help exits 0 and lists subcommands" {
+	skip_if_no_orca
+	run "$ORCA_BIN" --help
+	assert_status 0 "$status"
+	assert_contains "$output" "orca"
+	assert_contains "$output" "init"
+	assert_contains "$output" "job"
+	assert_contains "$output" "node"
+	assert_contains "$output" "ns"
+	assert_contains "$output" "secrets"
+	assert_contains "$output" "acl"
+	assert_contains "$output" "cache"
+}
+
+@test "orca version prints version line" {
+	skip_if_no_orca
+	run "$ORCA_BIN" version
+	assert_status 0 "$status"
+	assert_contains "$output" "orca version"
+	assert_contains "$output" "git commit"
+	assert_contains "$output" "build time"
+}
+
+@test "orca version --json emits valid JSON" {
+	skip_if_no_orca
+	run "$ORCA_BIN" version --json
+	assert_status 0 "$status"
+	assert_json_field "$output" "version"
+	assert_json_field "$output" "git_commit"
+	assert_json_field "$output" "build_time"
+}
+
+@test "orca cache show exits 0 against an empty cache" {
+	skip_if_no_orca
+	HOME_SANDBOX="$(mktemp -d)"
+	export ORCA_HOME="$HOME_SANDBOX"
+	run "$ORCA_BIN" cache show
+	assert_status 0 "$status"
+	assert_contains "$output" "Cache is empty"
+	rm -rf "$HOME_SANDBOX"
+}
+
+@test "orca cache show --json against an empty cluster emits null" {
+	skip_if_no_orca
+	HOME_SANDBOX="$(mktemp -d)"
+	export ORCA_HOME="$HOME_SANDBOX"
+	run "$ORCA_BIN" cache show --json
+	assert_status 0 "$status"
+	assert_contains "$output" "null"
+	rm -rf "$HOME_SANDBOX"
+}
+
+@test "orca acl list on an empty cluster prints no entries" {
+	skip_if_no_orca
+	HOME_SANDBOX="$(mktemp -d)"
+	export ORCA_HOME="$HOME_SANDBOX"
+	run "$ORCA_BIN" acl list
+	assert_status 0 "$status"
+	assert_contains "$output" "No ACL entries"
+	rm -rf "$HOME_SANDBOX"
+}
+
+@test "orca acl list --json on an empty cluster emits empty array" {
+	skip_if_no_orca
+	HOME_SANDBOX="$(mktemp -d)"
+	export ORCA_HOME="$HOME_SANDBOX"
+	run "$ORCA_BIN" acl list --json
+	assert_status 0 "$status"
+	assert_contains "$output" "[]"
+	rm -rf "$HOME_SANDBOX"
+}
+
+# gen_master_key <path> writes 32 random bytes to path with mode 0600
+# (the orca master key format). Uses /dev/urandom via dd.
+gen_master_key() {
+	local path="$1"
+	mkdir -p "$(dirname "$path")"
+	dd if=/dev/urandom of="$path" bs=32 count=1 2>/dev/null
+	chmod 0600 "$path"
+}
+
+@test "orca secrets list on an empty namespace reports no secrets" {
+	skip_if_no_orca
+	HOME_SANDBOX="$(mktemp -d)"
+	export ORCA_HOME="$HOME_SANDBOX"
+	mkdir -p "$ORCA_HOME/cluster" "$ORCA_HOME/testns"
+	gen_master_key "$ORCA_HOME/cluster/master.key"
+	run "$ORCA_BIN" secrets list testns
+	assert_status 0 "$status"
+	assert_contains "$output" "No secrets found"
+	rm -rf "$HOME_SANDBOX"
+}
+
+@test "orca unknown subcommand exits non-zero" {
+	skip_if_no_orca
+	run "$ORCA_BIN" bogus-subcommand
+	[ "$status" -ne 0 ]
+}
+
+@test "orca --json flag is accepted on the root command" {
+	skip_if_no_orca
+	run "$ORCA_BIN" version --json
+	assert_status 0 "$status"
+	assert_contains "$output" "\"version\""
+}