feat(cli): support remote debugging access requests (ALIEN-831)

[ab-alien-dev]

Summary

• Add --debug-tool/--debug-namespace/--debug-cloud-scope to alien access-requests create so a single access request can authorize operations, remote debugging (kubectl/aws/gcloud/az), or both.
• Add --access-request/--request-access/--access-duration to alien debug, so debug sessions can reuse or create the same access-request resource operations already use.
• Regenerate the Rust SDK's openapi.json mirrors from the platform API to pick up the new debugGrant fields and other API drift.
• Fix an unrelated ConfigureRemoteSandboxRequest field rename (imageBundleUri/maxSessionLifetimeSeconds -> maxLifetimeSeconds) surfaced by the SDK regeneration.

Companion PR in platform: unifies the same access-request system server-side (engineer/customer approval gates, debug_grant jsonb column, live-grant reuse) and updates apps/ai-agent to auto-propose debug access on debug_access_required.

Test plan

• cargo build -p alien-cli — clean build
• cargo test -p alien-cli --lib access_requests — 2/2 passing
• Verified end-to-end against a live Remote Operator deployment via the ai-agent/Slack flow (see platform PR)
• CI

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with one non-blocking CLI validation issue that can silently ignore an inapplicable cloud-scope option.

Findings

1.  Cloud scope is ignored ▶

Fix with agent prompt

### Issue 1
crates/alien-cli/src/commands/debug.rs:104-105
`--access-cloud-scope` is accepted without `--request-access`, but `debug_task` only reads it when creating a new request. When it is supplied with `--access-request`, the CLI silently reuses that request unchanged, which can mislead users into thinking the debug session has a narrower cloud scope. Make this option require `--request-access`, as its help text already implies.

```suggestion
    #[arg(long = "access-cloud-scope", requires = "request_access")]
    pub access_cloud_scope: Option<String>,
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR extends CLI access requests to cover remote-debugging grants, allows debug sessions to reuse or create approved access requests, and updates generated Platform API schemas.

• Adds operation/debug grant creation, display, waiting, duration, namespace, and cloud-scope handling.
• Passes access-request IDs into debug-session creation.
• Updates callers for regenerated Platform API fields and model changes.
• The latest revision addresses the prior duration and inferred-namespace findings.

Diagram

sequenceDiagram
    participant User
    participant CLI
    participant Platform
    participant Customer
    participant Manager

    User->>CLI: alien debug --request-access
    CLI->>Platform: Create debug access request
    Platform-->>CLI: Request ID
    loop Await approval
        CLI->>Platform: Get access request
        Customer->>Platform: Approve in cluster
    end
    Platform-->>CLI: Customer approved
    CLI->>Manager: Create debug session with request ID
    Manager-->>CLI: Authorized session
    CLI-->>User: Execute debug command

Loading

_{Reviews (2) · Last reviewed commit: "fix(cli): refresh vendored platform SDK,..."}