Grant a private resource to an environment

[vitramir]

Depends on agynio/api#184. Spec: agynio/architecture#178.

A sandbox workload matches no existing principal type. It carries no agent-<id> attribute — there is no agent class behind it — and it cannot be a group member, because groups collect users, agents, and apps. Nothing in the access model could name the engineer at a sandbox shell.

An environment principal resolves to every workload running that environment, agent workloads and sandboxes alike.

No new OpenZiti mechanism

The dial policy names environment-<id>, which the Orchestrator already stamps on every workload identity it creates and which egress rule attachments already target. Same per-resource service, same per-grant policy, same reconciliation, same ≤15s propagation. A workload already running picks the grant up on its next service-list poll without restarting, because the attribute predates the policy.

What had to branch

An environment is a configuration resource, not an identity, so it is not in the Identity registry:

• Existence and organization resolve through Agents.GetEnvironment instead of Identity.GetIdentityType. The call forwards the caller for the same reason the group lookup does — Agents authorizes environment reads against them.
• AGENTS_GRPC_TARGET joins the dependency set. WithAgentsClient keeps the existing constructors' signatures, since every other principal resolves without it.
• Authorization is can_edit_config on the environment — what an egress rule attachment to an environment already requires, and what the agent principal uses on its agent. Not organization owner: a grant here reaches anyone holding can_use, because they can start a sandbox and a sandbox is a shell. It adds a destination to what a shell there already reaches rather than widening who is standing in front of it. There is a test asserting org-owner alone is not enough.

Migration

ALTER TYPE ... ADD VALUE IF NOT EXISTS. The runner applies pending migrations in one transaction and PostgreSQL forbids using an enum value in the transaction that added it — the file says so for whoever adds the next one.

Note for the author

This branch was cut while internal/server/{provisioning,reconciliation,materialization_test}.go had uncommitted work in the tree (the ReturnExisting / keep-Ziti-IDs-on-failed-reprovision change). Only my hunk of provisioning.go is staged here — the environment case in principalRoleAttribute. That work is untouched and still sits unstaged locally.