test: use resource-scoped operations permission

[alongubkin]

Summary

• make the operations permissions test use a real permission set with the resource binding the command requires
• keep stack-only permission sets correctly rejected by the production generator

Root cause

The test selected the first permission set with any AWS configuration. observe/observe is valid but stack-only, while alien operations permissions intentionally generates a policy for BindingTarget::Resource. Registry ordering therefore made the test exercise an unsupported scope.

Validation

• cargo test -p alien-cli commands::operations::permissions::tests --lib (4 passed)
• git diff --check

Linear: ALIEN-798

[alongubkin]

@greptileai please review the current head.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because the selected permission set exists, contains AWS grants, and supports the resource binding exercised by the test.

Summary

• Replaces registry-order-dependent fixture selection with postgres/heartbeat.
• Preserves rejection of stack-only permission sets while exercising successful resource-scoped policy generation.

_{Reviews (1) · Last reviewed commit: "test: use resource-scoped operations per..."}