fix: preserve explicit resource permissions on links

[alongubkin]

Summary

A resource link still supplies a dependency and runtime binding. When its permission profile already has a resource entry, that entry now controls data access without broader automatic grants. Profiles without a resource entry retain the existing link and trigger defaults.

Verification

• All 330 alien-preflights library tests pass.
• A linked-container test checks distinct storage and queue rights, default grants, an explicit empty entry, and unchanged links.
• Rust formatting and git diff checks pass.

Follow-up

After release, verify generated AWS policies and role behavior on a fresh deployment. Existing installations may need a setup update to remove previously granted permissions.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violations remain.

Summary

This PR preserves explicitly configured resource permissions when processing resource links and worker triggers.

• Captures existing profile/resource targets before applying automatic grants.
• Skips link and trigger defaults whenever an explicit resource entry exists, including an intentionally empty entry.
• Adds regression coverage for distinct explicit permissions, default grants, empty grants, preserved links, and worker-trigger overrides.

_{Reviews (2) · Last reviewed commit: "test: cover explicit permissions on queu..."}

[alongubkin]

@greptile review