fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149)

Toolchain:
- go.mod: go 1.25.0 -> 1.25.12 (closes 24 stdlib vulns: archive/tar,
  crypto/tls, crypto/x509, net/http, net/url, encoding/pem, os)
- go mod tidy clean; make build + test + lint pass

Pre-existing test bugs fixed (surfaced by toolchain bump):
- acl_test.go: KindToken always denies (R-021); tests updated to KindOidc
- acl.go: parseIdentity defaults to KindOidc (was KindToken, making
  acl grant/check CLI path non-functional for non-spiffe identities)
- init_test.go: migration version updated to 0008 (was 0007, stale since v0.12)
- doctor.go: CertCA now checks CA cert exists (was only checking file modes,
  passing when no CA present)
- scenarios_test.go: ACL integration test uses KindOidc + acl.json 0600

---ci---
project: orca
phase: 1
milestone: v0.13
status: complete
requirements:
  covered: [149]
---/ci---

tests/integration/scenarios_test.go

@@ -273,7 +273,7 @@ func TestScenario_ACL(t *testing.T) {
 		t.Fatalf("mkdir cluster dir: %v", err)
 	}
 	a := acl.NewACL()
-	id := acl.Identity{Kind: acl.KindToken, ID: "operator-1"}
+	id := acl.Identity{Kind: acl.KindOidc, ID: "operator-1"}
 	a.Grant(id, "prod", acl.PermRead|acl.PermWrite)
 	if !a.Check(id, "prod", acl.PermRead) {
 		t.Error("expected read on prod after grant")
@@ -287,7 +287,7 @@ func TestScenario_ACL(t *testing.T) {
 	if a.Check(id, "staging", acl.PermRead) {
 		t.Error("cross-ns read should be denied")
 	}
-	admin := acl.Identity{Kind: acl.KindToken, ID: "root"}
+	admin := acl.Identity{Kind: acl.KindOidc, ID: "root"}
 	a.Grant(admin, "prod", acl.PermAdmin)
 	if !a.Check(admin, "prod", acl.PermRead) {
 		t.Error("admin should imply read")
@@ -303,7 +303,7 @@ func TestScenario_ACL(t *testing.T) {
 	if err != nil {
 		t.Fatalf("marshal acl: %v", err)
 	}
-	if err := writeAtomic(paths.ACLPath(), data, 0o644); err != nil {
+	if err := writeAtomic(paths.ACLPath(), data, 0o600); err != nil {
 		t.Fatalf("write acl.json: %v", err)
 	}
 	loaded, err := os.ReadFile(paths.ACLPath())