feat: support setup-only private endpoint access

[islo-labs]

Add deployment-wide endpointAccess (internet by default, or private) to setup settings. CloudFormation and Terraform expose typed inputs and deployment CLIs pass the choice through setup. Preflights reject unsupported targets and endpoint resource types; setup re-import refuses to change endpoint access. No application definition changes are required.

Tracks ALIEN-450.

Validation:

• cargo test -p alien-preflights --lib private_endpoints_reject_unsupported_targets passed, including GCP and Worker refusal. Core TypeScript build passed.
• Real AWS default-VPC deployments through prebuilt CLI release → setup link → CloudFormation: private ALB internal, Internet default internet-facing; both reached running with healthy targets. In-VPC /health returned HTTPS 200 with valid certificates. Private DNS returned private IPs and outside connections failed; Internet remained reachable outside.
• 200-request samples: private p50/p99 18.88/29.66 ms; Internet 18.21/26.70 ms; all successful. During v2 rollout, private had 8/449 HTTP 502s and Internet had 10/472. Both recovered; fresh v2 samples passed 200/200 each. The strict zero-error probes failed in both; this is not zero-downtime evidence.
• CloudFormation update private→internet rejected with “Endpoint access cannot change after setup. Create a new deployment to change endpoint access.” All validation cloud resources and artifacts cleaned up and absence verified.

Generated with pnpm --filter @alienplatform/core generate, pnpm generate:manager-rust-sdk, and pnpm generate:api-copy-openapi. Alon regenerated the manager TypeScript SDK with pnpm run generate:manager-api in c28b30863; its build and wire round trips pass. The platform TypeScript SDK changes only during releases and does not need feature-branch regeneration.

Round 2 validation on ce5c135ad:

• Merged main, included regenerated manager TypeScript SDK c28b30863, and resolved the setup-refresh finding in 627bee566. Overrides are checked after lock acquisition and fresh status; all three regression tests pass. Greptile rates the current head 5/5; the review thread is resolved.
• Regenerated CloudFormation/Terraform snapshots with INSTA_UPDATE=always cargo test -p alien-cloudformation -p alien-terraform --tests, and Helm snapshots with INSTA_UPDATE=always cargo test -p alien-helm --tests. All 396 active CloudFormation/Terraform tests pass with real validators and no snapshot drift; Helm and operator tests pass too. Snapshot/fixture changes do not change runtime behavior.
• Ran the complete CI non-cloud filter locally with cargo nextest run --no-fail-fast --workspace --features alien-manager/openapi,alien-bindings/platform-sdk, using CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0 CARGO_INCREMENTAL=0 CARGO_BUILD_JOBS=8. All 5,474 selected tests completed. After isolating the local Node host library from Bun, 5,467 pass; the remaining seven fail identically on main 410d789724425cdd1b9ae3fb096b8aea9f2042ba: three Docker ARM64-builder tests, two Docker/OCI export tests, one Docker registry-proxy pull, and one systemd-dependent machine-service test. No tests or assertions were weakened. Debug build artifacts were cleaned afterward.
• GitHub CI is fully green on this head: Rust crates (including non-cloud tests, Kubernetes lifecycle, remote operator lifecycle and sandbox checks), TypeScript packages and CLIs, and the aggregate All tests passed check. Ready for review; all actionable findings are resolved.

🤖 Generated with Claude Code

[enclave-ai]

Enclave skipped this draft pull request. It will run automatically when you mark the PR as Ready for review.

[islo-labs]

@greptileai Please review the latest commit for ALIEN-450.

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Adds a new immutable deployment configuration that controls endpoint reachability.

The reviewed changes appear safe to merge; no outstanding findings remain.

Summary

Adds setup-only endpoint access selection, defaulting to internet access. The PR passes the choice through deployment tooling and infrastructure templates, rejects unsupported private targets, and prevents changes after setup. The latest changes regenerate two Helm snapshots to reflect the default value.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Setup choice] --> B[Stack settings]
  B --> C[Preflight checks]
  C --> D[Deployment setup]
  B --> E[CloudFormation or Terraform inputs]
  D --> F[Endpoint access fixed after setup]

Loading

_{Reviews (8) · Last reviewed commit: "test: regenerate helm endpoint access sn..."}

[islo-labs]

@greptileai Please re-review latest head 627bee5. The setup-refresh finding is fixed, with regression coverage for initial setup, post-setup changes, and failed refreshes.

[islo-labs]

@greptileai Please review latest head c28b308, including the regenerated manager TypeScript SDK. The previous source head was rated 5/5.

[islo-labs]

@greptileai Please review latest head 7a5db33. Rust CI found four existing operator test fixtures missing endpoint_access; this commit explicitly sets their Internet default. cargo test -p alien-operator --lib passes all 95 tests. Runtime and generated contracts are unchanged.

[islo-labs]

@greptileai Please review latest head 15a7bb0. CI exposed stale package snapshots; regenerated 25 CloudFormation and 70 Terraform snapshots with INSTA_UPDATE=always cargo test -p alien-cloudformation -p alien-terraform --tests. All 396 active tests passed, including real artifact validators. Changes are expected endpoint-access fields only; no runtime changes.

[islo-labs]

@greptileai Please review latest head d6b6c5d. Rust CI found a stale Helm stack-settings serialization expectation; it now includes the Internet endpoint-access default. All 45 alien-helm tests pass with Helm and kubeconform validation enabled. Test-only change; runtime and generated contracts are unchanged.

[islo-labs]

@greptileai Please review current head ce5c135. The latest commit regenerates the two Helm snapshots to include the Internet endpoint-access default. No runtime changes. Full CI-filtered non-cloud validation is also running locally with --no-fail-fast.