fix(P05): final review fixes — PERSONAS.md body, config --addr precedence, migration 0007 dedup

Audit fix: PERSONAS.md body roster updated for v0.7 (was stale v0.6
content). Review P1-004: daemon --addr now uses cmd.Flags().Changed()
to detect explicit flag, so config listen_addr only applies when --addr
was not explicitly passed (correct flag>env>file>default precedence).
Review P1-001: migration 0007 now dedups existing duplicate serial_hex
rows before creating the UNIQUE index (backward-compat with v0.6 DBs
that accumulated duplicates before the constraint existed).

---ci---
project: orca
phase: 5
milestone: v0.7
status: execute
requirements:
  covered: [REQ-053, REQ-054, REQ-055, REQ-056]
  partial: []
---/ci---

internal/cli/daemon.go

@@ -36,7 +36,7 @@ var daemonCmd = &cobra.Command{
 
 		log := newLogger()
 		addr := daemonAddr
-		if cfg := configFromCtx(cmd.Context()); cfg != nil && cfg.ListenAddr != "" && addr == ":8080" {
+		if cfg := configFromCtx(cmd.Context()); cfg != nil && cfg.ListenAddr != "" && !cmd.Flags().Changed("addr") {
 			addr = cfg.ListenAddr
 		}
 		srv := daemon.NewServer(daemon.Options{

internal/store/migrations/0007_certs_serial_unique.sql

@@ -2,4 +2,16 @@
 -- issued by orca may share the same serial. Implemented as a UNIQUE
 -- INDEX so existing 0004_certs.sql need not be re-run on deployed
 -- databases. v0.7 P01 (REQ-053 companion).
+--
+-- P1-001 fix (final review): before creating the UNIQUE index, dedup
+-- any existing rows that share a serial_hex. Keep the newest row
+-- (MAX(created_at)) per serial_hex and delete older duplicates. This
+-- makes the migration backward-compatible with v0.6 deployments that
+-- may have accumulated duplicate serials before the constraint existed.
+DELETE FROM certs WHERE id NOT IN (
+  SELECT id FROM (
+    SELECT id, ROW_NUMBER() OVER (PARTITION BY serial_hex ORDER BY created_at DESC) AS rn
+    FROM certs
+  ) WHERE rn = 1
+);
 CREATE UNIQUE INDEX IF NOT EXISTS idx_certs_serial_unique ON certs(serial_hex);