fix: backport legacy observe grant removal

[alongubkin]

Summary

• backport the legacy automatic observe/observe removal compatibility fix onto the Alien revision currently consumed by Platform
• avoid pulling unrelated post-47eb8f69 binding changes into the urgent production deployment

Validation

• cargo test -p alien-preflights compatibility::permission_profiles_unchanged — 15 passed

Linear: ALIEN-388

[greptile-apps]

Greptile Summary

Backports compatibility handling that permits removal of the legacy automatic observe/observe grant only from management permissions.

• Compares old management profiles after omitting the exact legacy named grant.
• Allows an observe-only legacy management profile to return to automatic management.
• Keeps additions, named-profile changes, inline permission sets, and other management drift protected.
• Adds regression coverage for the permitted and rejected transitions.

Confidence Score: 5/5

The PR appears safe to merge, with the legacy compatibility exemption constrained to the intended old management grant.

The new comparison asymmetrically removes only the exact named observe/observe reference from old management permissions, while current stack mutation prevents that grant from entering the new application stack and all other permission drift remains checked.

Important Files Changed

Filename	Overview
crates/alien-preflights/src/compatibility/permission_profiles_unchanged.rs	Adds narrowly scoped legacy-grant normalization and regression tests without weakening checks for unrelated permission changes.
crates/alien-preflights/src/mutations/management_permission_profile.rs	Exposes the existing observe permission-set identifier within the crate so compatibility logic can reuse the canonical value.

_{Reviews (1): Last reviewed commit: "fix: allow legacy observe grant removal" | Re-trigger Greptile}