a2acli: name a non-success or paused task outcome in a stderr warning

## Summary

`A2ACLI_EXIT_002` has two halves. The first is implemented: tool execution and agent outcome are decoupled, so a turn `a2acli` conducted and reported exits `0` even when the task ends `FAILED`/`REJECTED` or pauses at `INPUT_REQUIRED`/`AUTH_REQUIRED`. The second is not:

> …the outcome is carried in the task state, and **a non-success or paused outcome SHOULD be named in a stderr warning** (§6.6, §11.6).

`a2acli` emits no such warning. The only `eprintln!` calls in `a2acli/src/lib.rs` are the error envelope, the `--insecure` warnings, and the world-readable `.env` warning. A `FAILED` task is reported on stdout in the task's `State:` field and exits `0` with a silent stderr — correct on the exit code, but a caller watching stderr sees nothing.

Per `COMPLIANCE.md` §4, a SHOULD inside a tier's requirement row is promoted to required for anyone claiming that tier, so this blocks the Tier 1 claim.

## Why

Exiting `0` on a `FAILED` task is deliberate and right — but it means the exit status alone cannot tell a caller that the agent did not succeed. The stderr warning is what makes the decoupling safe to rely on: stdout stays the machine-readable payload, stderr carries the human-visible "this did not succeed". Without it, a `FAILED` outcome in a CI log is indistinguishable from a clean one unless the consumer parses the state.

## Scope

- [ ] Emit a stderr warning naming the outcome whenever a reported task settles non-successfully (`FAILED`, `REJECTED`) or pauses (`INPUT_REQUIRED`, `AUTH_REQUIRED`), in **every** output mode — stderr carries diagnostics regardless of `-o`, the same rule the error envelope already follows (§11.4).
- [ ] Include the task id and the state; keep it one line and free of terminal control sequences.
- [ ] Apply it on every path that reports a settled task: `send` (blocking and `--stream`), `task get`, `task get --wait`, and `task cancel`.
- [ ] Do not emit it under `--async`, where no outcome has been observed yet.
- [ ] Keep stdout byte-identical — this adds nothing to the payload (§11.1).

## Requirements closed

| ID | Requirement |
| --- | --- |
| `A2ACLI_EXIT_002` | Tool execution and agent outcome stay decoupled; a non-success or paused outcome SHOULD be named in a stderr warning (§6.6, §11.6) |