feat(replication): add durable site repair lifecycle

[cxymds]

Related Issues

Closes rustfs/backlog#1498

Related: rustfs/backlog#1408, rustfs/backlog#1381, rustfs/backlog#1361

Summary

• add rc admin replicate repair dry-run|execute|status against the durable RustFS site-replication repair v1 contract
• require a separate dry-run, the complete HMAC-SHA256 preflight token, a caller-retained UUID, and explicit --yes before execute
• capability-gate every lifecycle command against the exact v4 contract, routes, modes, token format, UUID format, and retention advertisement
• preserve durable per-site, per-family, and per-task checkpoints in human and output-v3 JSON, including fresh-process status and same-ID partial retry with completed-task skips
• retain authoritative running, success, partial, and failed states; partial/failed snapshots keep complete JSON while exiting non-zero
• bound success and error bodies, reject malformed/inconsistent counters, timestamps, identifiers and categorical errors, and never retry an uncertain execute mutation
• distinguish redacted invalid plan/token, stale topology, operation-ID binding, concurrent operation, auth, missing operation, network, malformed response, and internal server failures
• extend output-v3 with strict repair preflight/operation/checkpoint schemas and golden/negative fixtures

Safety and Compatibility

• dry-run performs only capability discovery plus one dry-run request and never follows it with execute
• execute validates confirmation, token and UUID before capability discovery or mutation
• preflight tokens are redacted from Debug output and raw server error bodies are never propagated
• older RustFS servers return UnsupportedFeature after capability discovery without probing repair mutation routes
• existing site edit, status and resync commands are unchanged

Dependency

The server contract was merged in rustfs/rustfs#5217 and closed rustfs/backlog#1408.

Verification

• cargo fmt --all -- --check
• relevant cargo clippy ... -- -D warnings for rc-core, rc-s3, rc binary, admin_replicate, output_schema_v3 and help_contract
• cargo test -p rc-core (240 passed)
• cargo test -p rc-s3 (387 passed)
• cargo test -p rustfs-cli --test admin_replicate (46 passed)
• cargo test -p rustfs-cli --test output_schema_v3 (16 passed)
• cargo test -p rustfs-cli --test help_contract (3 passed)
• git diff --check

The repository-wide golden target remains environment/snapshot-order dependent on current main: five S3 fixtures require an external test service and four existing alias snapshots differ only by JSON key order. No golden updates from that run are included.

Adversarial review verdicts after fixes:

• Security/redaction: PASS
• Server contract correctness: PASS
• Durable retry/state semantics: PASS
• Mutation uncertainty/cancellation: PASS
• Resource bounds: PASS
• Output schema/compatibility: PASS
• Test quality/operations: PASS