fix: don't repeat a stack-wide grant for a linked resource

[alongubkin]

Fixes ALIEN-1120.

Problem

On AWS, AwsExactPermissionsSetupOwnedCheck refuses an exact-resource permission on a Live resource, and its message says to use a stack-scoped ('*') permission instead. Following that advice didn't work for linked resources:

• A container links a Live sandbox, and its profile grants "*": ["sandbox/execute"].
• ResourceLinkPermissionsMutation adds a link's default grant unless the profile has an entry for that exact resource id. A * entry didn't count, so it still added "agents": ["sandbox/execute"].
• The AWS check then rejected that added entry.

The same applies to Live queue, storage, kv and vault links.

Fix

The mutation skips a link's default permission set when the profile already grants it stack-wide. When nothing is left to add, it adds no per-resource entry at all.

Tests

• New a_stack_wide_grant_satisfies_a_live_link_on_aws: a container whose profile grants sandbox/execute stack-wide links a Live sandbox. After the real mutation, the profile has no agents entry and the real AWS check passes. With the filter disabled, the test fails.
• cargo test -p alien-preflights passes.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 4/5

[Medium risk] Adjusts permission grant logic for linked resources.

The PR is not ready to merge because its new inline-set case produces a grant that blocks AWS deployment.

Findings

1.  Live link fails AWS check ▶

Fix with agent prompt

### Issue 1
crates/alien-preflights/src/mutations/resource_link_permissions.rs:113-116
When a profile grants a narrower inline `sandbox/execute` set stack-wide and links a Live sandbox, this filter adds a built-in grant for that specific sandbox. The AWS prerequisite check rejects nonempty grants that target Live resources by ID, so the new inline-set test passes but the resulting deployment fails. The test checks that the grant was added but does not run the AWS check.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR avoids adding link-default grants already present stack-wide and adds AWS Live-link tests. The follow-up change correctly distinguishes inline sets from built-in references, but its inline-set case now produces an exact-resource grant that the AWS prerequisite check rejects.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A["Stack-wide inline set with built-in ID"] --> B["Link-grant filter does not count inline set"]
  B --> C["Add by-name grant for Live resource"]
  C --> D["AWS prerequisite rejects exact-resource grant"]

Loading

_{Reviews (2) · Last reviewed commit: "fix: only a built-in stack-wide set stan..."}

[alongubkin]

@greptileai