docs(milestone): complete scheduling-streaming (v0.3)

---ci---
project: orca
phase: 3
milestone: v0.3
status: complete
requirements:
  covered: [REQ-022, REQ-030, REQ-032]
  partial: []
---/ci---

v0.3 milestone merged to main. Includes all v0.2 work (P08-P10) that
was previously on the milestone branch but not yet merged to main, plus
the v0.3 completion work (iter.Seq streaming + doctor network/db).

v0.2 phases included: P08 (mTLS), P09 (scheduling), P10 (security scan).
v0.3 phases: P0 (pre-execution), P1 (iter.Seq streaming), P2 (doctor),
P3 (final review+ship).

Total: 40 requirements, all complete. No new go.mod dependencies.
Full test suite passes under -race. gofmt + go vet clean.

internal/cli/node.go

@@ -3,10 +3,12 @@ package cli
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
 	"fmt"
 	"log/slog"
 	"os"
-	"path/filepath"
+	"os/signal"
+	"syscall"
 	"time"
 
 	"github.com/google/uuid"
@@ -19,16 +21,8 @@ import (
 	"git.cloudinit.dev/coreci/orca/internal/store"
 )
 
-func dbPath() string {
-	if p := os.Getenv("ORCA_DB"); p != "" {
-		return p
-	}
-	home, _ := os.UserHomeDir()
-	return filepath.Join(home, ".orca", "orca.db")
-}
-
 func openDB() (*sql.DB, func() error, error) {
-	db, err := store.Open(dbPath())
+	db, err := store.Open(certpaths.DBPath())
 	if err != nil {
 		return nil, nil, err
 	}
@@ -54,6 +48,7 @@ var (
 	joinAddr     string
 	joinCAFinger string
 	leaveID      string
+	nodeWatch    bool
 )
 
 var nodeCmd = &cobra.Command{
@@ -155,8 +150,11 @@ var nodeLeaveCmd = &cobra.Command{
 var nodeListCmd = &cobra.Command{
 	Use:   "list",
 	Short: "List all nodes in the orca registry",
-	Long:  "Display all registered nodes and their state.",
+	Long:  "Display all registered nodes and their state. Use --watch to stream updates until Ctrl-C.",
 	RunE: func(cmd *cobra.Command, args []string) error {
+		if nodeWatch {
+			return watchNodes(cmd)
+		}
 		ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
 		defer cancel()
 
@@ -185,11 +183,79 @@ var nodeListCmd = &cobra.Command{
 	},
 }
 
+func watchNodes(cmd *cobra.Command) error {
+	ctx, cancel := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
+	defer cancel()
+	return watchNodesCtx(cmd, ctx)
+}
+
+func watchNodesCtx(cmd *cobra.Command, ctx context.Context) error {
+	db, closer, err := openDB()
+	if err != nil {
+		return err
+	}
+	defer closer()
+
+	out := cmd.OutOrStdout()
+
+	if jsonOutput {
+		seen := make(map[string]string)
+		for snapshot := range store.NewNodeRepo(db).Watch(ctx) {
+			current := make(map[string]bool, len(snapshot))
+			for _, n := range snapshot {
+				current[n.ID] = true
+				compact, _ := json.Marshal(n)
+				key := string(compact)
+				if prev, ok := seen[n.ID]; !ok || prev != key {
+					event := "init"
+					if ok {
+						event = "update"
+					}
+					line, _ := json.Marshal(map[string]any{"event": event, "node": n})
+					fmt.Fprintln(out, string(line))
+					seen[n.ID] = key
+				}
+			}
+			for id := range seen {
+				if !current[id] {
+					line, _ := json.Marshal(map[string]any{"event": "delete", "id": id})
+					fmt.Fprintln(out, string(line))
+					delete(seen, id)
+				}
+			}
+		}
+		return nil
+	}
+
+	prevTable := ""
+	for snapshot := range store.NewNodeRepo(db).Watch(ctx) {
+		table := renderNodeTable(snapshot)
+		if table != prevTable {
+			fmt.Fprint(out, "\033[2J\033[H")
+			fmt.Fprint(out, table)
+			prevTable = table
+		}
+	}
+	return nil
+}
+
+func renderNodeTable(nodes []*model.Node) string {
+	if len(nodes) == 0 {
+		return "No nodes registered.\n"
+	}
+	out := fmt.Sprintf("%-36s  %-20s  %-22s  %-10s\n", "ID", "NAME", "ADDRESS", "STATE")
+	for _, n := range nodes {
+		out += fmt.Sprintf("%-36s  %-20s  %-22s  %-10s\n", n.ID, n.Name, n.Address, n.State)
+	}
+	return out
+}
+
 func init() {
 	nodeJoinCmd.Flags().StringVar(&joinName, "name", "", "node name (required)")
 	nodeJoinCmd.Flags().StringVar(&joinAddr, "addr", "", "node address (default localhost:8443)")
 	nodeJoinCmd.Flags().StringVar(&joinCAFinger, "ca-fingerprint", "", "pin CA cert SHA-256 (REQ-026); fails if on-disk CA doesn't match")
 	nodeLeaveCmd.Flags().StringVar(&leaveID, "id", "", "node id")
+	nodeListCmd.Flags().BoolVar(&nodeWatch, "watch", false, "stream nodes until Ctrl-C (table refresh or --json per-event)")
 
 	nodeCmd.AddCommand(nodeJoinCmd)
 	nodeCmd.AddCommand(nodeLeaveCmd)