fix: preserve deployment reads across output schema additions

[alongubkin]

Deployment inspection currently fails when a newer server adds a field to certain resource outputs. Accept additive observations in key and access outputs while keeping resource configuration and known output field validation strict.

Manager deployment reads preserve the legacy key-output response for released clients using the unversioned alien-cli user agent. New CLIs send their version on every shared HTTP client, allowing current observations to remain visible without changing persisted reconciliation state.

Validation: three output compatibility regression tests pass; pnpm --dir packages/core generate and pnpm --dir packages/core build complete. The local Manager test build exhausted available disk space before finishing; route and HTTP client regressions await CI. Installed CLI 3.3.32 was also exercised against a synthetic loopback API/Manager: the original response reproduces the unknown available error, and the legacy response contract allows deployments get --json to succeed. This PR remains draft.

ALIEN-1528. Generated schemas were regenerated from Rust, not edited manually.

[enclave-ai]

Enclave skipped this draft pull request. It will run automatically when you mark the PR as Ready for review.

[alongubkin]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new blocking issue was found.

Summary

The PR lets key and access outputs accept added fields while keeping known fields and resource configuration strict.

• Deployment readers accept new fields in key and access outputs.
• Older CLIs can read deployments while the Manager keeps key availability.

The previous unnumbered finding about legacy clients erasing key availability is addressed. The Manager preserves the observation when the key identity and wrapping version match.

Diagram

sequenceDiagram
  participant CLI as Legacy CLI
  participant Manager
  participant Store
  CLI->>Manager: Read deployment
  Manager->>Store: Load stored stack
  Store-->>Manager: Key outputs with availability
  Manager-->>CLI: Response without available
  CLI->>Manager: Save step result
  Manager->>Manager: Restore availability for matching key
  Manager->>Store: Save restored state
  Manager-->>CLI: Response without available

Loading

_{Reviews (4) · Last reviewed commit: "test: use a deployment lifecycle failure..." · Reviewed by Greptile}

[alongubkin]

@greptileai review

Preserve stored key availability during legacy read/save round trips when provider identity and wrapping version still match. Keep the reconcile response compatible as well. Extended the route regression to read each response and POST the resulting state, asserting persisted availability remains false.

[alongubkin]

Urgent (ALIEN-1528): fixes legacy CLI deployment reads in prod. Independent review approved at 85%; CI green; Greptile 5/5; the first staging pass proved the fix. Merging on the owner's decision.