feat: scoped Kubernetes operation declarations (ALIEN-726)

[lilienblum]

Summary

Implements ALIEN-726 on main.

• Adds optional, versioned kubernetesPermissions declarations to public operation manifests.
• Allows reads plus pod deletion and workload scale patches; rejects wildcards, Secrets, privilege-bearing subresources, and broader writes.
• Compiles enabled custom requirements with baseline/builtin RBAC using stable scope keys while preserving attribution and resourceNames.
• Keeps RBAC setup-owned: plugin changes require re-rendering and reapplying the Role/ClusterRole.

Review repairs

Validation now rejects YAML line breaks in attribution and malformed Kubernetes API groups/resources, including subresource identifiers. Built-in groups, supported subresources, ordinary Unicode text, and named-resource behavior remain supported.

Verification

• cargo test -p alien-operations-sdk -p alien-helm --quiet: 82 unit/integration tests plus 1 doctest.
• Real Helm lint/template and disposable Kind positive, negative, and revocation checks passed.
• cargo fmt --check, focused Clippy, docs, and git diff --check passed.
• Independent $pr-review passed at exact head 596e6ef8c038aa07185a8ac27939c82a5d8e2597 with no material findings.

No live EKS/GKE/AKS claim is made.

[greptile-apps]

Greptile Summary

Adds versioned Kubernetes permission declarations for operations and compiles validated custom requirements into scoped operator RBAC.

• Validates API groups, resources, verbs, resource names, attribution text, schema versions, and risk-tier constraints.
• Deduplicates built-in, baseline, and custom grants while retaining operation attribution.
• Applies diagnostics/remediation permission ceilings and preserves namespace or cluster installation scope.
• Adds rendering and validation coverage for malformed identifiers, YAML injection, shared grants, and custom permissions.

Confidence Score: 5/5

The PR appears safe to merge with no outstanding findings.

No new actionable issue was introduced after the previous review, and the prior malformed-identifier thread was manually resolved after the validator was tightened.

Important Files Changed

Filename	Overview
crates/alien-operations-sdk/src/kubernetes.rs	Defines and validates versioned Kubernetes operation permission declarations; the prior identifier-validation finding is resolved.
crates/alien-operations-sdk/src/manifest.rs	Integrates optional Kubernetes permissions into operation manifest parsing and semantic validation.
crates/alien-helm/src/generator.rs	Merges validated custom permissions with built-in RBAC under stable scope keys and permission ceilings.
crates/alien-helm/tests/generator/operator_manifest_tests.rs	Covers scoped rendering, deduplication, permission ceilings, malformed declarations, and YAML attribution safety.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    Manifest[Operation manifest] --> Validate[SDK permission validation]
    Validate --> Enabled[Enabled custom operations]
    Enabled --> Ceiling[Diagnostics or remediation ceiling]
    Builtins[Built-in and baseline grants] --> Merge[Stable scoped grant merge]
    Ceiling --> Merge
    Merge --> Scope{Installation scope}
    Scope -->|Namespace| Role[Kubernetes Role]
    Scope -->|Cluster| ClusterRole[Kubernetes ClusterRole]

Loading

_{Reviews (3): Last reviewed commit: "chore: merge main after Kubernetes RBAC ..." | Re-trigger Greptile}