test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

Add table-driven rootCmd.Execute() tests for the node, job, cert,
doctor, audit, status, version, and node-capacity subcommand families.
Each test runs against a temp ORCA_HOME and asserts stdout/stderr/exit
via the existing initTestEnv/resetRootFlags/discardWriter helpers
(RESEARCH §1.2). extend resetRootFlags to also reset the per-command
flag-bound globals so tests don't leak state between runs.

daemon.go is excluded from the ≥70% target (documented in node_test.go):
the daemon command starts a long-running mTLS server whose lifecycle is
covered by internal/daemon/server_test.go; only its --pprof flag
registration is verified here (daemon_test.go).

Coverage: go test -cover ./internal/cli → 76.2% overall (78.7% by
-func), which includes daemon.go's untested RunE; the non-daemon files
exceed 70% comfortably. go test -race PASS.

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---

internal/cli/namespace_test.go

@@ -18,6 +18,21 @@ func resetRootFlags(t *testing.T) {
 	rootCmd.SetErr(&buf)
 	_ = rootCmd.PersistentFlags().Set("system", "false")
 	_ = rootCmd.PersistentFlags().Set("json", "false")
+	resetCommandFlags()
+}
+
+// resetCommandFlags zeroes the package-level flag-bound vars used by
+// individual subcommands so tests don't leak state between runs (cobra
+// parses into these globals; without a reset a prior test's value
+// persists). resetRootFlags calls this; tests that exercise a single
+// command without resetRootFlags may call it directly.
+func resetCommandFlags() {
+	joinName, joinAddr, joinCAFinger, joinType = "", "", "", "localhost"
+	joinHost, joinSSHUser, joinPassword, proxmoxUser, proxmoxRole = "", "root", "", "orca", "OrcaOperator"
+	joinSSHPort, leaveID, nodeWatch = 22, "", false
+	stopID, runTarget, runIDKey, jobWatch = "", "", "", false
+	capSetCPU, capSetMem, capSetDisk, capNodeID = 0, 0, 0, ""
+	auditLimit = 50
 }
 
 func TestNamespaceDefaultsToUserHome(t *testing.T) {