fix(aws): keep compute role policy setup-owned

[alongubkin]

Summary

• remove inline role-policy mutation from ComputeCluster management permissions
• keep the setup-created VM role policy under setup ownership
• add runtime and CloudFormation regressions proving management cannot mutate role policies

Verification

• cargo nextest run -p alien-permissions --test aws_runtime --test aws_cloudformation

[greptile-apps]

Greptile Summary

This PR restores setup ownership of the AWS compute VM role policy by removing inline-policy mutation authority from compute-cluster management.

• Removes iam:PutRolePolicy and iam:DeleteRolePolicy from the management permission set.
• Updates runtime-policy regression coverage to require both actions to remain absent.
• Updates CloudFormation-policy regression coverage with the same ownership constraint.

Confidence Score: 5/5

The PR appears safe to merge based on the repository-local permission contract and regression coverage.

The changed permission set consistently removes both inline role-policy mutation actions, and the runtime and CloudFormation tests enforce the intended setup-ownership boundary without introducing a demonstrated repository-local failure.

Important Files Changed

Filename	Overview
crates/alien-permissions/permission-sets/compute-cluster/management.jsonc	Removes management authority to mutate inline policies on setup-created compute roles, with no repository-local caller shown to require it.
crates/alien-permissions/tests/aws_cloudformation.rs	Replaces the positive role-policy mutation assertion with a regression asserting that generated CloudFormation management policies contain neither mutation action.
crates/alien-permissions/tests/aws_runtime.rs	Replaces the positive runtime grant assertion with a regression asserting that runtime management policies contain neither mutation action.

_{Reviews (1): Last reviewed commit: "fix(aws): keep compute role policy setup..." | Re-trigger Greptile}