Admin gating and ReadsStdin are per-handler conventions with no test #127

runAdminRepoVisibility (admin.go:417) and runAdminRepoDelete (:432) rely on adminRepo (:326) calling requireInstanceAdmin; runAdminRunners calls it directly. Nothing catches a new admin command that forgets. All 14 stdin commands set ReadsStdin today, by inspection only (control.go:108 drops stdin silently otherwise).

Remedy: gate Path[0]=="admin" in Dispatch; a test asserting ReadsStdin wherever Usage mentions stdin or --file -.