code-to10 v6 A5: admin CLI wiring for stale-worker reap

- New production caller cloud/worker_sweep.py (python -m
  cloud.worker_sweep): AuthStore.authenticate + CODEX_GLOBAL_ADMINS
  global-admin check (same fail-closed semantics as
  handler_admin._is_global_admin) before any reap call; denied
  authenticated non-admins get an admin_worker_sweep_denied audit
  row; authorized runs reuse reap_stale_workers (classify, re-verify,
  pre-kill audit fail-closed, per-pid SIGKILL only, post-kill
  verification) plus an admin_worker_sweep summary audit; --dry-run
  lists classifications only.
- No new HTTP route, no container enumeration, no name/prefix
  matching, no workers-row deletion; workers.py docstring only notes
  the new caller.
- Tests: cloud/tests/test_worker_sweep_admin.py, 6 cases (bad key,
  non-admin, unconfigured admin list fail-closed, authorized full
  chain, dry-run, CLI main authorized/refused).

(cherry picked from commit c7d217549c5ccedf61dcc924b8998fffeddc76c6)

cloud/workers.py

@@ -58,6 +58,9 @@
   注册行的去留是另一条决策（删行会改 /workers 列表语义），
   本轨不擅自删。亦不新增 HTTP 路由（会改 v1.1 契约）：调
   用方（管理员/清扫器）在有权限的上下文里直接调本函数。
+  生产调用方（A5 接线）：cloud/worker_sweep.py 的管理员 CLI
+  （鉴权 + reap 全链路），见该模块 docstring；除它与测试外
+  不再有其它生产调用方。
 """
 
 import os