fix: pin hosted cloud environment identity

[alongubkin]

Summary

• validate active cloud credentials against the environment of an already-applied hosted push setup
• fail before setup refresh or compute submission when AWS, GCP, or Azure identity differs
• cover matching and mismatched provider identities

Validation

• cargo test -p alien-deploy-cli --all-features
• cargo fmt --check -p alien-deploy-cli

[greptile-apps]

Greptile Summary

The PR pins an existing hosted push deployment to its recorded cloud identity before setup reconciliation or compute submission.

• Resolves the active AWS, GCP, or Azure identity from current credentials.
• Compares it with persisted deployment environment information and fails on mismatch.
• Adds provider-specific matching and mismatch coverage.

Confidence Score: 5/5

The PR appears safe to merge because the previously reported revision-gate bypass is fixed and no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/alien-deploy-cli/src/commands/up.rs	Adds pre-operation cloud identity validation independently of optional setup revision metadata, addressing the previously reported bypass.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Load current hosted push deployment] --> B{Persisted environment info exists?}
    B -->|Yes| C[Resolve identity from active cloud credentials]
    C --> D{Identity matches persisted environment?}
    D -->|No| E[Fail before cloud operations]
    D -->|Yes| F[Continue deployment workflow]
    B -->|No| F
    F --> G{Setup refresh required?}
    G -->|Yes| H[Refresh hosted setup]
    G -->|No| I{Hosted compute update required?}
    I -->|Yes| J[Submit compute update]
    I -->|No| K[Continue normal deployment]

Loading

_{Reviews (2): Last reviewed commit: "fix: pin hosted cloud environment identi..." | Re-trigger Greptile}