docs(P11): doc drift round 2 — README, cli.md, CHANGELOG, verify-reqs (REQ-160)

- README: status banner v0.12+v0.13, latest tag v0.12.10, subcommand
  table expanded (auth/nft/peer-setup/secrets rotate-master), "mTLS by
  default" corrected to "SSH-push canonical", docs table updated
- docs/cli.md: complete rewrite (521->1465 lines), all ~40 subcommands
- CHANGELOG: regenerated from git log (v0.11.29..HEAD)
- help text: job run HCL->markdown, job stop daemon->SSH-push
- docs/security-runbook.md: expanded to match P05 reality (seal/unseal,
  doctor audit/modes/oidc, incident response)
- docs/webauthn.md: added auth register (P06)
- docs/namespace.md: added inherit + set-constraint
- internal/proxmox/bootstrap.go: comments password->key auth
- internal/cli/status.go: deprecation warning
- scripts/verify-docs.sh + make verify-docs: cli.md <-> orca --help
- cmd/verify-reqs/main.go: fix bold-format regex (was bypassing v0.12)
  + case-insensitive status matching
- .ciagent/REQUIREMENTS.md: v0.12 REQs marked complete
- .ciagent/ROADMAP.md: v0.12 bolded COMPLETE

---ci---
project: orca
phase: 11
milestone: v0.13
status: complete
requirements:
  covered: [160]
---/ci---

internal/cli/job.go

@@ -47,8 +47,8 @@ var (
 )
 
 var jobRunCmd = &cobra.Command{
-	Use:   "run <spec.hcl>",
-	Short: "Run a job from an HCL spec file",
+	Use:   "run <spec.md>",
+	Short: "Run a job from a markdown spec file",
 	Long:  "Submit a job spec, execute its tasks, and persist the result. Use --target to pin to a specific node (overrides bin-packing); --idempotency-key for cross-node dispatch dedupe.",
 	Args:  cobra.ExactArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
@@ -216,7 +216,7 @@ func renderJobs(cmd *cobra.Command, jobs []*model.Job) error {
 		return printJSON(jobs)
 	}
 	if len(jobs) == 0 {
-		fmt.Fprintln(cmd.OutOrStdout(), "No jobs. Use 'orca job run <spec.hcl>' to submit one.")
+		fmt.Fprintln(cmd.OutOrStdout(), "No jobs. Use 'orca job run <spec.md>' to submit one.")
 		return nil
 	}
 	fmt.Fprintf(cmd.OutOrStdout(), "%-36s  %-20s  %-12s  %-8s\n", "ID", "NAME", "STATUS", "EXIT")

internal/cli/status.go

@@ -6,9 +6,21 @@ import (
 
 var statusCmd = &cobra.Command{
 	Use:   "status",
-	Short: "Show orca daemon status",
-	Long:  "Display the current status of the local orca daemon, including version, uptime, and connection info.",
+	Short: "Show orca daemon status (deprecated)",
+	Long: `Display the current status of the local orca daemon, including
+version, uptime, and connection info.
+
+**Deprecated (v0.13):** This command is a v0.1 stub that reports a
+hardcoded "daemon stopped" status. The daemon model was replaced by
+SSH-push in v0.9 (R-001) and the dual-write window closed in v0.12
+(REQ-138). Use the canonical commands instead:
+
+  orca node list          # node registry + state
+  orca metrics /healthz   # liveness/health probe (daemon-mode only)
+
+This command will be removed in a future release.`,
 	RunE: func(cmd *cobra.Command, args []string) error {
+		warnDeprecated("orca status is deprecated (v0.1 stub): use 'orca node list' for node state and 'orca metrics /healthz' for health probes")
 		status := map[string]any{
 			"version":   version,
 			"daemon":    "stopped",
@@ -23,7 +35,7 @@ var statusCmd = &cobra.Command{
 		}
 		printText("orca daemon status\n")
 		printText("  version:   %s\n", version)
-		printText("  daemon:    %s\n", "stopped (daemon not yet implemented in Phase 1)")
+		printText("  daemon:    %s\n", "stopped (deprecated v0.1 stub; use 'orca node list' + 'orca metrics /healthz')")
 		printText("  api_addr:  %s\n", "https://localhost:8443")
 		printText("  phase:     %s\n", "1-cli-skeleton")
 		printText("  milestone: %s\n", "v0.1")