Fix authz policy set import fallback when prereq resource types are missing

[Copilot]

frodo authz set import --prereqs could fail when policy set import hit Resource Type <uuid> does not exist, even when the export payload included resourcetype. The current prereq path in frodo-lib uses a PUT-only flow; this change adds a CLI-side recovery path for that failure mode.

• What changed

  • Added a guarded fallback in src/ops/PolicySetOps.ts around policy set import execution.
  • On a structured prereq failure (404 + missing resource type signal), the CLI:
    1. imports resource types from the same payload via frodo.authz.resourceType.importResourceTypes(...) (create-or-update semantics),
    2. retries the same policy set import with prereqs: false to bypass the failing prereq branch.
  • Applied consistently to:
    • importPolicySetFromFile
    • importFirstPolicySetFromFile
    • importPolicySetsFromFile
    • importPolicySetsFromFiles

• Error handling behavior

  • Fallback is narrowly scoped to the known missing-resource-type prereq error shape.
  • Non-matching errors preserve existing behavior and are rethrown.

• Implementation detail

  • Added internal helpers:
    • shouldRetryPolicySetImportAfterPrereqFailure(...)
    • importPolicySetWithPrereqFallback(...)

await importPolicySetWithPrereqFallback(
  (importOptions) => importPolicySet(policySetId, fileData, importOptions),
  fileData,
  options
);
// on eligible 404 prereq failure:
//   await importResourceTypes(fileData)
//   retry with { ...options, prereqs: false }