Admin Rerun Nudge Scan

RES-014-B — operator trigger for the re-run nudge scan/dispatch pass.

The nudge is built but DISABLED by default (RERUN_NUDGE_ENABLED OFF — population/retention-gated). This admin-gated endpoint lets the operator run a scan once the flag is flipped (and to dry-run reach beforehand — dry_run=True is the default so a stray click sends nothing).

Returns the scan summary, including fenced_out_non_customer_key (the AC-06 cost fence in action) so the operator can confirm Badge-paid-fallback agents are excluded before any live send.

404 when ADMIN_DASHBOARD_ENABLED is off (rule #4 — fail explicit), so the admin surface stays uniformly gated. When RERUN_NUDGE_ENABLED is off the scan returns enabled=false and does nothing.