feat(swarm-authelia-bridge): report a heal as its own outcome

`EnsureAgentIdentity` answered `AlreadyExists` whether it had added the
agent marker to an existing subject or done nothing at all, and the
controller discarded the answer outright. So the one case worth telling
a human about — a subject that was NOT an agent a moment ago — could not
survive the socket, let alone reach a log.

`Healed` is a variant rather than a field on `AlreadyExists` because a
field is ignorable: adding a variant makes every existing match fail to
compile until its author decides what a heal means. That is the property
the old shape lacked.

The store cannot tell a pre-marker agent identity from a human operator
account created without a group — both are `groups: []`. So this is
either the intended migration or an agent joining a person's live SSO
account, and only the caller has the context to tell them apart.

Gated by state/gate-3549-heal.sh (8 arms + mutation): the mutation
collapses Healed back and reddens the discriminating arm while leaving
the anti-noise arm green. The W' control asserts exactly one warn in the
whole run, so a build that warned on every routine ensure would fail.

swarm-controller/src/main.rs

@@ -36,6 +36,7 @@ use axum::{
 };
 use hive_jobq_wire::GraphWire as _;
 use serde::{Deserialize, Serialize};
+use swarm_authelia_bridge_sock::BridgeResponse;
 use utoipa::{OpenApi, ToSchema};
 use utoipa_axum::{router::OpenApiRouter, routes};
 
@@ -150,6 +151,19 @@ async fn run_swarm_node(
                 Outcome::Failed("no swarm-authelia-bridge is configured on this host".to_owned())
             }
             Some(bridge) => match bridge.ensure_agent_identity(&agent).await {
+                // Matched rather than discarded with `Ok(_)`: a heal writes
+                // to a subject this job did not create, and that has to
+                // reach a human. `Outcome` has no success-carrying variant,
+                // so the controller's own log is the only channel a
+                // succeeding node has today.
+                Ok(BridgeResponse::Healed) => {
+                    tracing::warn!(
+                        %agent,
+                        "swarm jobq: create_identity marked an EXISTING identity as an \
+                         agent — verify this name did not belong to a person"
+                    );
+                    Outcome::Done
+                }
                 Ok(_) => Outcome::Done,
                 Err(e) => Outcome::Failed(format!("{e:#}")),
             },