Bound local owner product-config grants

[shiny-code-bot]

Purpose

Bound the remaining local owner/operator compatibility grants so product_config.plan and product_config.apply are not granted as wildcard product/context access by default.

Current Status

Done.

PR #1068 (Scope local operator product config grants) merged into main at 2026-05-31T18:51:26Z with merge commit ba4bcaf312952f7583eda0581fedc84077dac69b.

What changed:

• Replaced default wildcard local-operator product_config.plan / product_config.apply grants with scoped product/context grants.
• Derived default scopes from the typed seed import catalog instead of granting */*.
• Added LAUNCHPLANE_LOCAL_OPERATOR_PRODUCT_CONFIG_SCOPES_JSON for explicit operator override scopes.
• Added regression coverage proving local-operator product-config grants are scoped and not wildcarded.
• Updated operations docs for the scoped default and rare broad-repair path.

Validation:

• git diff --check
• shellcheck scripts/deploy/ensure-authz-grants.sh
• uv run --extra dev ruff check tests/test_product_onboarding.py
• uv run python -m unittest tests.test_product_onboarding
• GitHub CI, CodeQL, Security, and frontend checks passed on Scope local operator product config grants #1068 before merge.

Remaining cleanup is local worktree hygiene only: GitHub could not delete the checked-out local branch because the worktree still exists. No product behavior is blocked by that.

Finish Line

• Routine local owner/operator product_config.plan/apply grants are scoped to explicitly configured products/contexts instead of wildcard defaults.
• Local admin remains the explicit escalation path for broader repair/administrative scopes where still needed.
• Tests or static assertions catch accidental reintroduction of wildcard local owner product_config.plan/apply grants.
• Docs/plans describe the bounded compatibility posture.

Acceptance Criteria

• scripts/deploy/ensure-authz-grants.sh no longer posts wildcard local owner product_config.plan/apply grants as a default deploy behavior.
• Any replacement scope is either derived from existing Launchplane-owned product/seed material or from explicit environment configuration; missing config fails closed or skips with clear evidence rather than silently granting wildcard access.
• Targeted tests pass.

Recovery Notes

Parent: #1049. Related umbrella: #1041.