fix(aws): allow compute role policy reconciliation

[alongubkin]

Summary

• let the compute-cluster management controller refresh the generated execute policy on setup-created runtime roles
• let it remove the legacy inline policy during reconciliation
• keep both actions scoped to roles under the deployment stack prefix

Why

Capacity updates reconcile the node execution policy before changing the fleet. The generated management role already owns fleet reconciliation, but lacked the IAM actions required for this narrow step, causing AWS updates to fail before reaching the ASG.

Verification

• runtime AWS permission generation
• CloudFormation permission generation
• permission operation coverage

[greptile-apps]

Greptile Summary

The PR grants the compute-cluster management controller narrowly scoped permission to update and delete inline policies on setup-created AWS compute roles.

• Adds iam:PutRolePolicy and iam:DeleteRolePolicy for stack-prefixed role names ending in -role.
• Covers runtime and CloudFormation permission generation with exact resource-pattern assertions.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/alien-permissions/permission-sets/compute-cluster/management.jsonc	Adds inline-policy reconciliation permissions using a role-specific stack-prefix pattern that no longer includes the management role identified by the prior thread.
crates/alien-permissions/tests/aws_cloudformation.rs	Verifies CloudFormation generation includes both IAM actions and the narrowed role ARN pattern.
crates/alien-permissions/tests/aws_runtime.rs	Verifies runtime generation includes both IAM actions and the narrowed role ARN pattern.

_{Reviews (2): Last reviewed commit: "fix(aws): narrow compute role policy sco..." | Re-trigger Greptile}