Make datumctl inventory plugin type-aware for the property-graph model (Node/Edge)

[ecv]

Summary

Make the datumctl inventory plugin type-aware so it can render and operate on the property-graph model (typed Node + Edge with attribute bags) proposed in milo-os/inventory#43 and prototyped in milo-os/inventory#44.

Motivation

The graph model collapses the ~13 NetBox-inspired CRDs into two generic kinds (Node, Edge). That trades away per-kind CRD ergonomics:

• Print columns. Today kubectl get site shows typed columns (Region, Type, …). One generic Node CRD can only expose type + attribute-blob columns — kubectl get node.graph loses the per-kind view.
• Discoverability. Operators browse inventory by asset class (sites, racks, hosts). A flat node list keyed by spec.type is hard to scan without client-side grouping.

A type-aware datumctl plugin recovers this UX client-side: it reads the NodeType/EdgeType schema registry and renders per-type tables, filters, and validation hints without needing N CRDs.

Scope

• Read NodeType/EdgeType to learn each type's attribute keys + value types.
• datumctl inventory get <type> — list Nodes of a given spec.type with attribute-derived columns (e.g. get site shows displayName/siteType pulled from attributes).
• datumctl inventory get edges --type=located-in [--from=… --to=…] — list/filter edges.
• Graph traversal helpers (e.g. inventory neighbors <node>, follow located-in/member-of).
• Reuse / extend the apply path from Native datumctl inventory apply to replace bin/load-inventory #2 (native datumctl inventory apply) for the graph kinds.

Dependencies / references

• RFC: RFC: Collapse the inventory kinds into one node and edge model milo-os/inventory#43
• Prototype PR: Property-graph model (Node + Edge) — M1 spike for #43 milo-os/inventory#44
• Native apply: Native datumctl inventory apply to replace bin/load-inventory #2
• datumctl plugin release wiring: Release wiring for datumctl-inventory plugin (goreleaser) milo-os/inventory#42

Blocked on the graph model landing (or being installable side-by-side, as the prototype is under group graph.inventory.miloapis.com).

[ecv]

RBAC for graph.inventory.miloapis.com — two PRs (apply in order)

The v1alpha2 plugin (#10) reaches the graph group but is denied — the group has no Milo IAM. Two PRs, by repo, in dependency order:

1. feat: add Milo IAM for graph.inventory.miloapis.com (v1alpha2) milo-os/inventory#45 — defines the IAM: ProtectedResources for Node/Edge/NodeType/EdgeType + graph.inventory.miloapis.com-{viewer,editor,admin,operator} Roles (mirrors the existing inventory.miloapis.com IAM). Merge + apply to Milo first.
2. datum-cloud/infra#2706 — grants it: viewer PolicyBindings binding the inventory-viewers group to graph.inventory.miloapis.com-viewer across the 4 kinds (staging). References the role names from Configure Renovate #1, so Configure Renovate #1 must land first.

After both: datumctl inventory get/types/tree/... work for inventory-viewers members (read).

Remaining (separate): write/editor binding for the loader rides with datum-cloud/infra#2705 (loader migration); production parity (no prod milo IAM overlay yet).