refactor(cmd): slug-anchored authz seam (S09 Enforcement plan: 4/20)

David Fernandezrequested to merge
10io/s09-enforcement-step-4 into main

⚙️ What does this MR do and why?

Step 4 of the S09 authorization-enforcement plan: the slug-anchored authorization wiring seam.

mountSlugAnchoredFormats alone widens to carry the IAM and GLAZ clients (authz.RelationshipResolver, authz.PolicyChecker), and the authorization wrap gate (slugAnchoredAuthzConfigured, mirroring wireOCIWithStore's iamClient != nil && glazClient != nil) is computed where the clients enter. Nothing is wrapped yet: the Maven and npm wiring steps each add their wrap line inside this helper instead of widening a shared signature, and buildRootDispatcher keeps its two-argument signature, so its precedence tests are untouched.

Behavior is unchanged with the clients present or nil — the gate's value is discarded until the wraps land and consult it.

📐 Plan deviation

The plan's Files entry says to "compute the gate locally, mirroring wireOCIWithStore". The gate is an unexported function instead of an inline local: the plan's own Tests line asks for the gate's value to be pinned under both client states, which an inline local cannot expose to a test. TestSlugAnchoredAuthzConfigured pins all four nil/non-nil client pairs.

✅ Verification

  • go build, go vet (plain and -tags=integration), package tests, golangci-lint (plain and --build-tags=integration --max-same-issues=0 --max-issues-per-linter=0 --uniq-by-line=false) all pass; the integration lint reports only pre-existing findings on lines this diff does not touch.
  • scripts/ci/check-comment-caps.sh --base origin/main passes.
  • e2e scenario catalogs: no update — behavior-preserving refactor, no scenario is added or affected.

Related to #846 (closed)

Merge request reports