feat(D): capacity auto-discovery + partial updates + ACL debug + UX (REQ-168,169)

- node capacity set: partial updates (only set dimensions passed;
  read-modify-write on existing row)
- node capacity auto [percentage]: SSH to node, discover CPU (nproc),
  memory (/proc/meminfo), disk (df), multiply by percentage (default 75)
- ACL check --verbose: prints resolved ACLPath + all entries + identity
- job list UX: short 8-char IDs, NODE column, conditional EXIT (- for
  non-terminal statuses)

---ci---
project: orca
milestone: v0.12.18
phase: D
status: complete
requirements:
  covered: [168, 169]
---/ci---

internal/cli/acl.go

@@ -32,6 +32,7 @@ var (
 	aclRevokeNamespace  string
 	aclCheckNamespace   string
 	aclCheckPermission  string
+	aclCheckVerbose     bool
 )
 
 var aclCmd = &cobra.Command{
@@ -351,6 +352,16 @@ read, write, admin (default: read).`,
 		}
 		identity.Namespace = ns
 		allowed := a.Check(identity, ns, perm)
+		if aclCheckVerbose {
+			fmt.Fprintf(cmd.ErrOrStderr(), "ACL path: %s\n", paths.ACLPath())
+			fmt.Fprintf(cmd.ErrOrStderr(), "Identity: kind=%s id=%s ns=%s\n", identity.Kind, identity.ID, ns)
+			fmt.Fprintf(cmd.ErrOrStderr(), "Permission: %s -> allowed=%v\n", permStr, allowed)
+			entries := a.List()
+			fmt.Fprintf(cmd.ErrOrStderr(), "ACL entries (%d):\n", len(entries))
+			for _, e := range entries {
+				fmt.Fprintf(cmd.ErrOrStderr(), "  kind=%s id=%s ns=%s perms=%d\n", e.Identity.Kind, e.Identity.ID, e.Namespace, e.Permissions)
+			}
+		}
 		if jsonOutput {
 			return printJSON(map[string]any{
 				"identity":   identity,
@@ -373,6 +384,7 @@ func init() {
 	aclGrantCmd.Flags().StringVar(&aclGrantPermissions, "permissions", "read", "comma-separated permissions: read,write,admin")
 	aclRevokeCmd.Flags().StringVar(&aclRevokeNamespace, "namespace", "", "namespace scope (required for tokens; defaults to spiffe path ns)")
 	aclCheckCmd.Flags().StringVar(&aclCheckNamespace, "namespace", "", "namespace scope (required for tokens; defaults to spiffe path ns)")
+	aclCheckCmd.Flags().BoolVar(&aclCheckVerbose, "verbose", false, "print ACL path + loaded entries for debugging")
 	aclCheckCmd.Flags().StringVar(&aclCheckPermission, "permission", "read", "permission to check: read, write, or admin")
 
 	aclCmd.AddCommand(aclGrantCmd)