…the whole policy (2/4) (#630)

* fix(restriction_policies): drop stale principals instead of skipping the whole policy

Overrides `connect_resources` so that, under `--drop-unresolvable-principals`, a principal
absent from both destination and source state (permanently gone — e.g. a role deleted
before the org's first-ever import) is dropped from its binding and the policy still syncs,
instead of the entire restriction policy being skipped on a single dead reference.

- Principals present in source but not destination keep today's hard-fail/retry behavior.
- If dropping empties a binding whose source list was non-empty, the resource is still
  skipped and flagged as an access-elevation risk (ERROR + metric), governed by
  `--skip-failed-resource-connections` like any other connection failure.
- The "id" (dashboard/slo/notebook) connections keep the generic path unchanged.
- `extract_source_ids` is intentionally left unaffected (documented) so minimize-reads
  lazy-loading can still resolve which principals to check.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* fix(monitors,synthetics_tests): drop stale restricted_roles/principals under new flag (3/4) (#631)

* fix(monitors,synthetics_tests): drop stale restricted_roles/principals under new flag

Applies the same drop-aware pattern (PR1 helpers) to the two resource types that carry
both a flat `restricted_roles` list and a `restriction_policy.bindings.principals` composite:

- monitors: `restricted_roles` + `restriction_policy.bindings.principals`
- synthetics_tests: `options.restricted_roles` + `restriction_policy.bindings.principals`

Each `connect_resources` override keeps all non-access-control connections on the generic
path, filters access-control references through the shared helpers, and preserves the
empty-binding/empty-list access-elevation hard-fail. `extract_source_ids` left unaffected
(documented). Behavior is unchanged when `--drop-unresolvable-principals` is off.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* fix(dashboards,synthetics_private_locations): drop stale restricted_roles under new flag (#632)

Completes the rollout by applying the flat-list drop-aware filter to the two remaining
resource types with a `restricted_roles` list:

- dashboards: `restricted_roles`
- synthetics_private_locations: `metadata.restricted_roles`

Both previously had trivial pass-through `connect_id` overrides; they now get a
`connect_resources` override that filters stale roles under `--drop-unresolvable-principals`
while keeping widget/other connections on the generic path and preserving the empty-list
access-elevation hard-fail. Adds a new unit test module for synthetics_private_locations.

Co-authored-by: Claude Sonnet 5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5 <[email protected]>

…ffolding (1/4) (#629)

* feat: add --drop-unresolvable-principals flag and drop-aware connection scaffolding

Adds the opt-in `--drop-unresolvable-principals` flag plus the shared, inert-when-off
machinery that later PRs wire into individual resource models. No behavior changes when
the flag is absent (the default).

- New `--drop-unresolvable-principals` CLI option (in `_diffs_options`, so it applies to
  sync/diffs/migrate) threaded through the `Configuration` dataclass.
- `BaseResource._resolve_or_drop`: three-way resolver distinguishing destination-present,
  source-present ("not yet synced", hard-fail as today), and permanently-gone
  (absent from both — droppable only under the flag).
- Shared `_filter_stale_binding_principals` / `_filter_stale_flat_roles` /
  `_raise_connection_error_if_any` helpers (rebuild lists rather than mutating in place,
  avoiding the enumerate/index-shift bug).
- `ResourceConnectionError.empty_binding_risk` flag for the access-elevation case.
- New `Counter` buckets (stale drops, empty-binding risks) + reset, surfaced by
  `_emit_apply_summary`; `config.counter` back-reference so models can record drops.
- `_apply_resource_cb` adds a `risk:empty_restriction_policy` metric tag when a binding
  emptied out.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* fix: report suppressed empty-binding connection risks

* fix: recheck destination after lazy state load

* refactor: name resource connection results

* fix(restriction_policies): drop stale principals instead of skipping the whole policy (2/4) (#630)

* fix(restriction_policies): drop stale principals instead of skipping the whole policy

Overrides `connect_resources` so that, under `--drop-unresolvable-principals`, a principal
absent from both destination and source state (permanently gone — e.g. a role deleted
before the org's first-ever import) is dropped from its binding and the policy still syncs,
instead of the entire restriction policy being skipped on a single dead reference.

- Principals present in source but not destination keep today's hard-fail/retry behavior.
- If dropping empties a binding whose source list was non-empty, the resource is still
  skipped and flagged as an access-elevation risk (ERROR + metric), governed by
  `--skip-failed-resource-connections` like any other connection failure.
- The "id" (dashboard/slo/notebook) connections keep the generic path unchanged.
- `extract_source_ids` is intentionally left unaffected (documented) so minimize-reads
  lazy-loading can still resolve which principals to check.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* fix(monitors,synthetics_tests): drop stale restricted_roles/principals under new flag (3/4) (#631)

* fix(monitors,synthetics_tests): drop stale restricted_roles/principals under new flag

Applies the same drop-aware pattern (PR1 helpers) to the two resource types that carry
both a flat `restricted_roles` list and a `restriction_policy.bindings.principals` composite:

- monitors: `restricted_roles` + `restriction_policy.bindings.principals`
- synthetics_tests: `options.restricted_roles` + `restriction_policy.bindings.principals`

Each `connect_resources` override keeps all non-access-control connections on the generic
path, filters access-control references through the shared helpers, and preserves the
empty-binding/empty-list access-elevation hard-fail. `extract_source_ids` left unaffected
(documented). Behavior is unchanged when `--drop-unresolvable-principals` is off.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* fix(dashboards,synthetics_private_locations): drop stale restricted_roles under new flag (#632)

Completes the rollout by applying the flat-list drop-aware filter to the two remaining
resource types with a `restricted_roles` list:

- dashboards: `restricted_roles`
- synthetics_private_locations: `metadata.restricted_roles`

Both previously had trivial pass-through `connect_id` overrides; they now get a
`connect_resources` override that filters stale roles under `--drop-unresolvable-principals`
while keeping widget/other connections on the generic path and preserving the empty-list
access-elevation hard-fail. Adds a new unit test module for synthetics_private_locations.

Co-authored-by: Claude Sonnet 5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5 <[email protected]>