feat: request time-boxed operation access from the CLI

[ab-alien-dev]

Summary

• Adds alien access-requests create/get/wait so CLI/API callers (customers running their own AI agent, or a human) can request time-boxed operation access without Slack.
• create supports both exact (--operation <plugin>/<operation>) and wildcard (--operation <plugin>/* + --max-risk) requests through a single --operation flag.
• get/wait fetch and print the customer's actual kubectl patch ... approve command once the operator materializes the grant CR, polling briefly so it's available right after creation rather than requiring a follow-up call.
• operations invoke --request-access creates an access request, waits for approval, then re-invokes the operation.
• Approval always happens on the customer's side, in-cluster — there is deliberately no CLI action that approves a request.

Test plan

• cargo check -p alien-cli and cargo test -p alien-cli --lib access_requests pass
• Manually exercised end-to-end against a local kind cluster: create → operator materializes grant CR → kubectl patch approve → wait/invoke dispatches → verified pod restart via kubectl get pods
• Manually exercised the wildcard path (--operation 'kubernetes/*' --max-risk mutating)

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR adds CLI support for creating, inspecting, and waiting on time-boxed operation-access requests, including automatic access requests during operation invocation.

• Adds exact and wildcard access-request creation.
• Exposes in-cluster approval coordinates and approval polling.
• Re-invokes operations after approval and reports post-operation verification separately.
• Updates the generated Platform API contracts used by the Rust client.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/alien-cli/src/commands/access_requests.rs	Adds access-request creation, retrieval, approval-coordinate polling, and approval waiting with human and JSON output modes.
crates/alien-cli/src/commands/operations.rs	Adds access-request-assisted invocation and post-operation verification while resolving the previously reported JSON-output, error-propagation, and polling-deadline issues.
crates/alien-cli/src/lib.rs	Registers and dispatches the new platform-only access-requests command.
client-sdks/platform/openapi.json	Updates the Platform API contract consumed by generated clients for access requests and operation invocation.

Sequence Diagram

sequenceDiagram
  participant Caller
  participant CLI
  participant Platform
  participant Operator
  participant Customer
  participant Deployment

  Caller->>CLI: operations invoke --request-access
  CLI->>Platform: Invoke operation
  Platform-->>CLI: Pending approval
  CLI->>Platform: Create access request
  Operator->>Platform: Report grant coordinates
  CLI->>Platform: Poll request and coordinates
  CLI-->>Caller: Request ID and kubectl command on stderr
  Customer->>Operator: Approve grant in cluster
  CLI->>Platform: Poll until approved
  CLI->>Platform: Re-invoke with access request ID
  Platform->>Deployment: Dispatch operation
  Deployment-->>CLI: Operation result
  CLI->>Platform: Check verification
  CLI-->>Caller: One final JSON result on stdout

Loading

_{Reviews (3): Last reviewed commit: "fix: address second round of greptile fi..." | Re-trigger Greptile}