Add the Fleet Ops demo: multi-tenant fleet authorization on the Go SDK

[Zivxx]

What this adds

fleet-ops-demo/: a multi-tenant fleet operations app on the Permit Go SDK (permit-golang v1.2.8). Customer
organizations own regions, sites, trucks and teams; partners get access to single trucks; a platform operator
("Fleet Ops") manages every organization. Every page and every write is decided by a local container PDP
(pdp-v2:0.9.16), and a panel beside each page shows every check, the PDP's answer and why: the relationship route,
the attribute rule's conditions with the values evaluated, the tenant-isolation verdict and the custom policy version.

It shows 17 scenarios (the README has the walkthrough): role derivation down a five-level tree, scoped admin
delegation, nested organizations, re-parenting, team supervisors, partner access on named trucks, owner vs.
operator, a broker across three organizations, certification-gated service, attribute-based resource sets,
tenant isolation, lifecycle gating, time-boxed break-glass access, revocation, organization merges and audit.

Most of it is Permit's built-in RBAC, ReBAC and ABAC. Tenant isolation and the owner/operator, certification,
lifecycle and time-boxed rules are custom Rego installed in the environment's GitOps branch by make apply-policy
and ANDed into every allow; the README says which scenario uses which.

Also: the folder's CI workflow (govulncheck, gofmt, vet, staticcheck, race tests, opa check and opa test), its
pre-commit hooks, a Dependabot entry for its Go module and the root README row.

How it was checked

• The 16-step walkthrough, end to end, against a live Permit environment and container PDP, before the platform
  operator's tenant key was renamed. Every step behaved as the README describes; writes reached the PDP 0.6 to 0.8 s
  after the API call; the original 51 pre-flight checks (make verify; 53 now, with the two H1 rows) pass after a reset.
• The review fixes (below): go test -race ./... (every package), 41/41 Rego tests on OPA 0.42.2 and on 1.21.1
  with --v0-compatible, staticcheck, govulncheck (0 reachable vulnerabilities), typos, gitleaks, actionlint and
  zizmor, all clean locally.
• The owner/operator fix (H1) against a live PDP: the fixed rule loaded into a running pdp-v2:0.9.16 denies the
  two bypass cases with acting_org_mismatch, keeps the operator's own access, and the original 51 pre-flight checks
  still match.
• Not run: this exact copy against a Permit environment from make setup. The tenant-key rename needs a fresh
  environment; the rename is mechanical, and the Rego and Go tests use the new key.

Review

Reviewed with two Go verifiers (idioms, risk) and one fixer pass. Every finding and what happened to it:

Finding	Verdict	What changed
Risk H1: a role the truck's owner granted counted while acting for the operating organization	Fixed	acting_org_ok requires the operator's own roles (operator_org_allow); 10 Rego tests, 2 new pre-flight rows (53 checks)
Risk H2: make setup/reset could act on a different environment than .env names	Fixed	.env key only (a different shell key is an error), no parent-folder lookup, cmd/sync resolves and prints the key's scope and refuses a mismatch
Idioms HIGH-1: failed PDP/OPA reads treated as "absent"	Fixed	Reads and waits return errors; "can't read" is reported apart from "missing"; no guessed reason when debug is unavailable
Idioms HIGH-2: actions reported success when the PDP never caught up	Fixed	Lagging writes say "Permit has the change, but the PDP doesn't confirm it"
Risk M1: tier 3 could be given from a stale copy of a person's attributes	Fixed	Attribute changes read Permit's current attributes inside the action
Risk M2: another site's page could drive writes through the localhost server	Fixed	Host check, http.CrossOriginProtection, JSON-only writes, ReadHeaderTimeout
Risk M3: the People page listed an organization's roster with every check denied	Fixed	Denied unless one of its checks is allowed
Risk M4: one write freezes every page; no request context	Deferred	Needs a context threaded through every API call and wait; releasing the lock changes the app's consistency model
Risk M5: writes continue when the custom rules drop out of root.rego	Premise rejected, comments fixed	Permit doesn't regenerate root.rego on schema or dashboard changes; only a base-policy update can overwrite it. Misleading comments corrected
Risk L1: "Remove from Permit" deletes the person everywhere	Rejected	That is the scenario ("nothing left behind"); not reachable with the seed
Risk L2: transfer/merge ignored wait results; create retried after a timeout	Partly fixed	Wait results reported (HIGH-2); create-retry idempotency deferred
Risk L3: some keys put into HTML attributes unescaped	Fixed	esc() on 12 interpolations
Risk L4: Rego's platform key not tied to the Go constant	Fixed	Test
Idioms MEDIUM-1: unwrapped errors	Fixed	About 57 call sites say what failed
Idioms MEDIUM-2: listRaw errors carried no status code	Fixed	permitapi.HTTPError, recognised by the retry logic
Idioms MEDIUM-3: no dependency audit; Go 1.23 out of support	Fixed	govulncheck job gating the Go job; Go 1.26 (toolchain go1.26.9)
Idioms MEDIUM-4: the root.rego contract tested on two separate fixtures	Fixed	One order-insensitive recogniser next to RootAllow, with a contract test
Idioms MEDIUM-5: logic packages without tests	Partly fixed	Tests for explain, permitapi, settings, checks, sync, pdp and server; cmd/verify, cmd/server and most action happy paths still untested
Idioms LOW-1: .env parsing differed from Compose	Fixed	Quotes and inline comments handled like Compose

For the reviewer

@zeevmoney, over to you:

• The web UI is yours to replace; web/ only got escaping and a denied branch for the People page.
• The README's "Notes on the Go SDK" and "Notes on the PDP" document real quirks (an SDK delete with swapped
  argument names, list calls that return nothing, a delete-and-recreate race in the PDP). Keep them here, or move
  them to tickets?
• Every organization and person in the seed is fictional.
• Needs Go 1.26 or later, and OPA 1.0 or later for make test.

🤖 Generated with Claude Code