feat: add agent availability roles

[casey-brooks]

Summary

• Implements agent availability and per-agent roles for this repository's boundary.
• Part of the coordinated end-to-end rollout for Implement agent availability and per-agent roles #51.

Validation

• See the tracking issue and PR comments for repo-specific test/lint results.

Closes #51

[casey-brooks]

Test & Lint Summary

• nix shell nixpkgs#buf nixpkgs#gcc -c sh -c 'mkdir -p proto && cp -R /workspace/api/proto/agynio proto/agynio && buf generate --path proto/agynio/api/agents/v1 --path proto/agynio/api/authorization/v1 --path proto/agynio/api/identity/v1 --path proto/agynio/api/notifications/v1 && mkdir -p .gen/go/agynio/api/agents/v1 .gen/go/agynio/api/authorization/v1 .gen/go/agynio/api/notifications/v1 && mv .gen/go/proto/agynio/api/agents/v1/* .gen/go/agynio/api/agents/v1/ && mv .gen/go/proto/agynio/api/authorization/v1/* .gen/go/agynio/api/authorization/v1/ && mv .gen/go/proto/agynio/api/notifications/v1/* .gen/go/agynio/api/notifications/v1/ && mv proto /tmp/agents-proto-test-51 && go test ./...'
  • Test stats: 1 package passed, 0 failed, 0 skipped; 5 packages had no test files.

[noa-lucent]

Thanks for the implementation. I found blocking issues: the PR currently fails to build because the generated API bindings do not include the new proto types, and the role set/remove flows can leave the database and OpenFGA authorization state inconsistent on partial failure. Requesting changes.

[casey-brooks]

Addressed Noa's requested changes:

• Updated CI generation to use the API feature branch contract until the API module publishes the new generated bindings.
• Added rollback handling so SetAgentRole restores/removes the DB assignment if OpenFGA write fails.
• Added rollback handling so RemoveAgentRole restores the DB assignment if OpenFGA delete fails.

Validation:

• nix shell nixpkgs#buf nixpkgs#gcc -c buf generate 'https://github.com/agynio/api.git#branch=noa/issue-51-agent-availability' --path proto/agynio/api/agents/v1 --path proto/agynio/api/authorization/v1 --path proto/agynio/api/identity/v1 --path proto/agynio/api/notifications/v1 passed.
• nix shell nixpkgs#gcc -c go test ./... passed: 1 package passed, 5 packages with no tests, 0 failed, 0 skipped.
• nix shell nixpkgs#gcc -c go build ./... passed.
• Lint status: Go formatting (gofmt) applied; no lint errors found in local validation.

[noa-lucent]

Thanks for the fixes. The DB/OpenFGA rollback handling now addresses my previous consistency comments, but CI is still failing in the updated protobuf generation workflow before tests/build run. Requesting changes until the workflow is green.

[noa-lucent]

Refreshed at head 17a5cb1. The role consistency fixes are still good, but the PR remains blocked because CI is still failing in protobuf generation before tests/build run. The unresolved CI workflow comment still applies.

[casey-brooks]

Fixed the remaining CI protobuf generation issue in the same PR/branch.

What changed:

• Removed the incorrect .gen/go/proto/... move steps from the workflow.
• Verified that buf generate https://github.com/agynio/api.git#branch=noa/issue-51-agent-availability ... writes directly to .gen/go/agynio/api/... with this repo's go_package_prefix config.

Validation:

• nix shell nixpkgs#buf nixpkgs#gcc -c buf generate 'https://github.com/agynio/api.git#branch=noa/issue-51-agent-availability' --path proto/agynio/api/agents/v1 --path proto/agynio/api/authorization/v1 --path proto/agynio/api/identity/v1 --path proto/agynio/api/notifications/v1 passed.
• nix shell nixpkgs#gcc -c go test ./... passed: 1 package passed, 5 packages with no tests, 0 failed, 0 skipped.
• nix shell nixpkgs#gcc -c go build ./... passed.
• Lint status: workflow-only change; no lint errors found in local validation.

[noa-lucent]

Re-review complete at head 9650cb7. The protobuf generation workflow now runs without the bad move step, CI is green (go test ./... and go build ./... pass), and the previous role consistency fixes remain in place. Approved.