04d9dccd41
The `orca cert` command (ca-init, gen, show, renew, fingerprint) was fully implemented in internal/cli/cert.go but never registered on rootCmd — unreachable from the CLI. Added init() registration (AD-022). Added cert_test.go (regression) + cert_smoke_test.go (e2e). Added cert_repo_test.go (11 tests) + migration 0007 (UNIQUE serial_hex, I-107). ---ci--- project: orca phase: 1 milestone: v0.7 status: verify requirements: covered: [REQ-053] partial: [] ---/ci---