fix(admin): support root heal task status and stop

[cxymds]

Related issue

• No issue linked.

Background

rc admin heal start <ALIAS> can start a root recursive manual heal and returns a client token, but token-only status and stop requests were rejected. Operators could start a root heal task but could not inspect or stop that same task with the returned token.

Root cause

The CLI required --bucket whenever --client-token was present, and the S3 adapter rejected an empty bucket instead of mapping the root task target to /heal/.

Solution

• Accept token-only root heal task status and stop requests while preserving tokenless global status.
• Map an empty task target to /heal/ and cover the exact root status and stop HTTP contracts.
• Update the README and admin command reference with the root heal workflow.
• Include the design and implementation plan used for the change.

User impact

Users can now run rc admin heal status <ALIAS> --client-token <TOKEN> and rc admin heal stop <ALIAS> --client-token <TOKEN> for root heal tasks started without a bucket.

BREAKING

This PR updates the protected CLI behavior reference. The command change is additive and backward compatible; no config migration or output schema bump is required.

Validation

• cargo fmt --all --check
• cargo clippy --workspace -- -D warnings
• cargo test --workspace

[Copilot]

Pull request overview

This PR fixes the “root heal task” workflow in rc admin heal by allowing operators to query/stop a root recursive manual heal using only the --client-token returned by heal start, while preserving the existing tokenless global background status behavior.

Changes:

• Relax CLI validation to allow token-only task scoping for heal status and heal stop (root tasks use an empty bucket).
• Update the S3 admin adapter to map an empty task target to /heal/ and add request-contract tests for root status/stop routes.
• Document the root token workflow in the README and the protected admin command reference, and add design/plan docs.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Updates heal examples to include the root token-based status/stop workflow.
docs/superpowers/specs/2026-07-15-heal-root-token-task-design.md	Adds the design spec describing behavior matrix, routing, and test strategy.
docs/superpowers/plans/2026-07-15-heal-root-token-task.md	Adds an implementation plan covering validation, routing, tests, and docs updates.
docs/reference/rc/admin.md	Documents token-only root task status/stop and updates the heal workflow contract.
crates/s3/src/admin.rs	Adds root-aware heal task path mapping and request-contract tests for root status/stop.
crates/cli/src/commands/admin/heal.rs	Allows token-only root task requests and adds CLI unit tests for the new validation matrix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.