feat(D): capacity auto-discovery + partial updates + ACL debug + UX (REQ-168,169)

- node capacity set: partial updates (only set dimensions passed;
  read-modify-write on existing row)
- node capacity auto [percentage]: SSH to node, discover CPU (nproc),
  memory (/proc/meminfo), disk (df), multiply by percentage (default 75)
- ACL check --verbose: prints resolved ACLPath + all entries + identity
- job list UX: short 8-char IDs, NODE column, conditional EXIT (- for
  non-terminal statuses)

---ci---
project: orca
milestone: v0.12.18
phase: D
status: complete
requirements:
  covered: [168, 169]
---/ci---

internal/cli/node_capacity_test.go

@@ -10,16 +10,18 @@ import (
 	"git.cloudinit.dev/coreci/orca/internal/store"
 )
 
-func TestNodeCapacitySetMissingArgs(t *testing.T) {
+func TestNodeCapacitySetPartialUpdate(t *testing.T) {
 	_, cleanup := initTestEnv(t)
 	defer cleanup()
 	resetRootFlags(t)
 	var buf bytes.Buffer
 	rootCmd.SetOut(&buf)
 	rootCmd.SetErr(&buf)
+	// REQ-168: partial updates are now allowed. Setting only --cpu
+	// should succeed (memory/disk default to 0 or existing values).
 	rootCmd.SetArgs([]string{"node", "capacity", "set", "--cpu", "1000"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for capacity set missing memory/disk, got nil")
+	if err := rootCmd.Execute(); err != nil {
+		t.Fatalf("expected success for partial capacity set, got: %v", err)
 	}
 }