docs(P11): doc drift round 2 — README, cli.md, CHANGELOG, verify-reqs (REQ-160)

- README: status banner v0.12+v0.13, latest tag v0.12.10, subcommand
  table expanded (auth/nft/peer-setup/secrets rotate-master), "mTLS by
  default" corrected to "SSH-push canonical", docs table updated
- docs/cli.md: complete rewrite (521->1465 lines), all ~40 subcommands
- CHANGELOG: regenerated from git log (v0.11.29..HEAD)
- help text: job run HCL->markdown, job stop daemon->SSH-push
- docs/security-runbook.md: expanded to match P05 reality (seal/unseal,
  doctor audit/modes/oidc, incident response)
- docs/webauthn.md: added auth register (P06)
- docs/namespace.md: added inherit + set-constraint
- internal/proxmox/bootstrap.go: comments password->key auth
- internal/cli/status.go: deprecation warning
- scripts/verify-docs.sh + make verify-docs: cli.md <-> orca --help
- cmd/verify-reqs/main.go: fix bold-format regex (was bypassing v0.12)
  + case-insensitive status matching
- .ciagent/REQUIREMENTS.md: v0.12 REQs marked complete
- .ciagent/ROADMAP.md: v0.12 bolded COMPLETE

---ci---
project: orca
phase: 11
milestone: v0.13
status: complete
requirements:
  covered: [160]
---/ci---

cmd/verify-reqs/main.go

@@ -16,17 +16,20 @@ import (
 // the Phase + Status match at the END of the line, where those two columns
 // always live. The status token is optionally wrapped in markdown bold
 // (real rows use `**Complete**`; synthetic/future rows may use bare
-// `Pending`), and may carry trailing notes (e.g. "**Complete** (P01
-// shipped v0.2.1)") matched by [^|]* before the closing pipe.
-var reqRowRe = regexp.MustCompile(`^\|\s*(REQ-\d+)\s*\|.*\|\s*([^|]*?)\s*\|\s*\*{0,2}(Complete|Pending)\*{0,2}[^|]*\|\s*$`)
+// `pending` or `complete` in any case), and may carry trailing notes
+// (e.g. "**Complete** (P01 shipped v0.2.1)") matched by [^|]* before
+// the closing pipe. The (?i) flag makes the match case-insensitive so
+// lowercase `pending` (used by v0.12/v0.13 REQ rows) is captured;
+// normalizeStatus canonicalizes the captured value to title case.
+var reqRowRe = regexp.MustCompile(`(?i)^\|\s*(REQ-\d+)\s*\|.*\|\s*([^|]*?)\s*\|\s*\*{0,2}(Complete|Pending)\*{0,2}[^|]*\|\s*$`)
 
 // milestoneCompleteRe matches a ROADMAP.md milestone header that is marked
-// COMPLETE. The bold span is substring-tolerant (GRILL #4): it matches
-// `**COMPLETE**`, `**COMPLETE (merged to main via v0.3)**`, and any future
-// variant where the word COMPLETE appears inside the bold span, possibly
-// preceded or followed by non-asterisk text. The milestone version (v0.X)
-// is captured.
-var milestoneCompleteRe = regexp.MustCompile(`^##\s*Milestone\s+(v0\.\d+):.*—\s*\*\*[^*]*\bCOMPLETE\b[^*]*\*\*`)
+// COMPLETE. The bold markers are optional (GRILL #4 + REQ-160 T11): it
+// matches `**COMPLETE**`, `**COMPLETE (merged to main via v0.3)**`, and
+// bare `COMPLETE` (as used by the v0.12 milestone header). The word
+// COMPLETE may be preceded or followed by non-asterisk text. The milestone
+// version (v0.X) is captured.
+var milestoneCompleteRe = regexp.MustCompile(`^##\s*Milestone\s+(v0\.\d+):.*—\s*\*{0,2}[^*]*\bCOMPLETE\b[^*]*\*{0,2}`)
 
 // phaseRe extracts the milestone version from a REQUIREMENTS Phase cell such
 // as `v0.7 P1`, `**v0.2 P01**`, `v0.2 P01–P04`, or bare `v0.7`. The cell may
@@ -40,6 +43,17 @@ type reqRow struct {
 	status string // "Complete" or "Pending"
 }
 
+// normalizeStatus canonicalizes a captured status token to the title-case
+// form ("Complete" or "Pending") so that case-insensitive matches like
+// "pending" or "complete" compare correctly against the drift assertions.
+func normalizeStatus(s string) string {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return s
+	}
+	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
+}
+
 // milestoneVersions returns the distinct v0.X milestones referenced in the
 // phase cell (e.g. "v0.7 P1" → ["v0.7"]; "v0.2 P01 / v0.3 P02" →
 // ["v0.2","v0.3"]).
@@ -174,7 +188,7 @@ func parseRequirements(path string) ([]reqRow, error) {
 		if m == nil {
 			continue
 		}
-		rows = append(rows, reqRow{id: m[1], phase: strings.TrimSpace(m[2]), status: m[3]})
+		rows = append(rows, reqRow{id: m[1], phase: strings.TrimSpace(m[2]), status: normalizeStatus(m[3])})
 	}
 	if err := sc.Err(); err != nil {
 		return nil, err