feat: add source admin api surface

docs/current_roadmap.md

@@ -100,6 +100,10 @@ implementation state.
       public `RpcWorkflowApiClient` still satisfies `WorkflowApiSurface`, while
       client methods and server JSON-RPC registrations live in focused
       capability, draft, artifact, deployment, and run modules.
+   - Completed: read-only source inventory now has a protocol-neutral
+      `WorkflowSourceAdminApi` / `WorkflowSourceAdminSurface`; MCP admin source
+      tools delegate through it while connection/raw MCP operations remain
+      broker-owned.
 
 5. **CLI/API alignment**
    - Completed for the basic lifecycle: selected `wf` commands can target local

docs/superpowers/specs/2026-06-03-cli-api-alignment-notes.md

@@ -80,11 +80,10 @@ surface, or plain local CLI utilities.
 
 ## Next Slices
 
-1. **Server source/admin operations**
-   - Add a protocol-neutral admin/source surface for source listing, source
-     health, and dynamic source registration.
-   - Do not overload `WorkflowApiSurface` if the operation is not a workflow
-     lifecycle operation.
+1. **Source/admin transport and CLI commands**
+   - Build JSON-RPC methods and `wf source ...` commands over
+     `WorkflowSourceAdminSurface`.
+   - Keep mutation out until the store-backed source registry is designed.
 
 2. **Store-backed source registry**
    - Config can bootstrap sources, but server-owned dynamic source changes