fix(cli): a capability-only onboard link allows only what its package registers (ALIEN-1241)

[ItamarZand88]

Summary

A link from alien onboard --setup-items sandbox (or any capability without the application) could not be installed: the setup page asked for telemetry auto, and the capability package only accepts off. Without the application, onboard now allows only the modes that package registers.

Step-by-step flow when you run alien onboard acme --setup-items sandbox:

1. onboard creates a deployment link with a policy of the stack settings the customer may pick.
2. The customer opens the link; the setup page requests each setting's preferred mode that the policy allows.
3. The capability package registers network none, telemetry off, approval-required updates and heartbeats on, so the policy now allows exactly those. ← the fix
4. The customer launches the CloudFormation stack.

This PR changes a capability-only link from "every mode allowed" to "only the modes its package accepts".

What was broken

The link allowed telemetry auto, so the setup page requested it and refused to launch: "This CloudFormation package supports telemetry mode 'off', but this setup requests 'auto'."

What I did

• platform_onboard_deployment_setup_config takes includes_application; without the application it allows network none, telemetry off, updates approval-required, heartbeats on.
• A link that includes the application builds exactly the same policy as before.
• woz: nothing to remove (one bool parameter, four lists).

Files touched

• crates/alien-cli/src/commands/onboard.rs: the policy for capability-only links, and a test for it.

How I tested

• What I ran: created two sandbox-only links in a test project and opened each setup page in headless Chrome. From the released CLI 3.3.27 the page shows the telemetry error; from this branch's CLI it shows no error and offers "Launch in AWS Console".
• Unit tests: a_capability_only_link_allows_the_settings_its_package_registers failed before the fix (left: [Off, Auto, ApprovalRequired], right: [Off]) and passes now; all 20 commands::onboard tests pass.
• Not tested: a link with both the application and a capability. Its policy is unchanged here, so its capability setup may still request auto.

Safe because a link that includes the application gets the identical policy it got before: the includes_application branches keep the previous lists verbatim (see the diff). Not covered by a test.

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Onboarding link now restricts capabilities based on package registration.

The PR appears safe to merge; no actionable issue was established.

Summary

The PR narrows the four stack-setting mode lists for platform onboarding links that omit the application, while preserving the existing lists for links that include it.

• Adds a unit test for the capability-only policy.

_{Reviews (1) · Last reviewed commit: "fix(cli): a capability-only onboard link..."}