fix(cloud-tests): address release remediation review

[tofikwest]

Summary

• stop retry flows from executing guided-only/manual remediation previews
• preserve info severity for manual remediation preview risk
• require a real selector for RevokeSecurityGroupIngressCommand validation while still allowing rule-ID-only revokes

Verification

• bunx jest src/cloud-security/aws-command-executor.spec.ts src/cloud-security/manual-remediation.spec.ts --passWithNoTests
• bunx jest src/cloud-security --passWithNoTests --testPathIgnorePatterns=remediation.controller.spec.ts
• bunx vitest run src/trigger/tasks/cloud-security
• bunx eslint src/cloud-security/aws-command-executor.ts src/cloud-security/aws-command-executor.spec.ts src/cloud-security/manual-remediation.ts src/cloud-security/manual-remediation.spec.ts
• bunx eslint src/trigger/tasks/cloud-security/retry-preview.ts src/trigger/tasks/cloud-security/retry-preview.test.ts src/app/'(app)'/'[orgId]'/cloud-tests/actions/batch-fix.ts src/app/'(app)'/'[orgId]'/integrations/'[slug]'/actions/batch-fix.ts
• bunx prettier --check apps/api/src/cloud-security/aws-command-executor.ts apps/api/src/cloud-security/aws-command-executor.spec.ts apps/api/src/cloud-security/manual-remediation.ts apps/api/src/cloud-security/manual-remediation.spec.ts apps/app/src/trigger/tasks/cloud-security/retry-preview.ts apps/app/src/trigger/tasks/cloud-security/retry-preview.test.ts apps/app/src/app/'(app)'/'[orgId]'/cloud-tests/actions/batch-fix.ts apps/app/src/app/'(app)'/'[orgId]'/integrations/'[slug]'/actions/batch-fix.ts
• git diff --check

Notes

• apps/app typecheck still fails on existing baseline issues outside this patch, including stale component test fixtures, AI SDK v2/v3 type mismatches, and better-auth duplicate package types.

---

Summary by cubic

Prevents retry flows from executing guided-only/manual remediations, tightens Security Group revoke validation, and preserves info risk for manual remediation previews.

• Bug Fixes
  • Retry flow: added classifyRetryPreview and wired it into both batch-fix actions to stop guided-only cases and continue permission prompts when missingPermissions are present.
  • AWS validation: RevokeSecurityGroupIngressCommand now requires either SecurityGroupRuleIds or rule property params (not both), with clearer errors; rule-ID-only revokes remain allowed.
  • Manual remediation: accepts and returns info severity for preview risk.

^{Written for commit 1b3b84a. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Building	Preview, Comment	May 22, 2026 12:56am
comp-framework-editor	Ready	Preview, Comment	May 22, 2026 12:56am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		May 22, 2026 12:56am

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[claudfuen]

🎉 This PR is included in version 3.62.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀