fix(cli): count superadmins as able to preserve ownership on push (#11653)

Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cli/src/core/permissioned_as.ts

@@ -34,10 +34,14 @@ export async function buildPermissionedAsContext(
     return undefined;
   }
   const user = await wmill.whoami({ workspace });
+  // A superadmin acts as admin in every workspace, so the backend preserves
+  // ownership for them even when their own `usr` row there is not an admin.
   const userIsAdminOrDeployer =
-    user.is_admin || (user.groups ?? []).includes("wm_deployers");
+    user.is_admin ||
+    user.is_super_admin ||
+    (user.groups ?? []).includes("wm_deployers");
   log.debug(
-    `permissioned_as: user=${user.email}, is_admin=${user.is_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`
+    `permissioned_as: user=${user.email}, is_admin=${user.is_admin}, is_super_admin=${user.is_super_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`
   );
   return {
     userCache: new Map(),

cli/test/permissioned_as_context_unit.test.ts

@@ -0,0 +1,27 @@
+/**
+ * Regression guard: a superadmin whose `usr` row in the workspace is not an
+ * admin still preserves ownership on the backend, so the CLI must not refuse
+ * their push as if it would reassign every item to them.
+ */
+
+import { expect, test } from "bun:test";
+import { mockServices } from "./mock_services.ts";
+
+mockServices({
+  whoami: async () => ({
+    email: "super@windmill.dev",
+    username: "super",
+    is_admin: false,
+    is_super_admin: true,
+    groups: [],
+  }),
+});
+
+const { buildPermissionedAsContext } = await import(
+  "../src/core/permissioned_as.ts"
+);
+
+test("a superadmin with a non-admin membership counts as able to preserve", async () => {
+  const ctx = await buildPermissionedAsContext("w", "v1");
+  expect(ctx?.userIsAdminOrDeployer).toBe(true);
+});