fix(supervisor-network): warn on unsupported L7 access presets

[lunarwhite]

Summary

Emit a visible warning when an L7 endpoint uses an unsupported access preset (e.g. access: allow) during proxy-side preset expansion. Previously these values were silently ignored, leaving endpoints with no expanded rules and no diagnostic when traffic was denied.

Policy load and deny behavior are unchanged. This is observability only.

Related Issue

Closes #2008

Related: #2158 (invalid access: allow reports policy_denied; this PR adds the missing load-time warning but does not fix incomplete policy shape)

Changes

• Return warnings from expand_access_presets for unsupported access values (read-only, read-write, and full remain supported)
• Extract access_preset_rules helper to centralize preset expansion logic
• Extract emit_l7_config_warnings helper to deduplicate validation + expansion OCSF emission
• Emit expansion warnings via OCSF ConfigStateChangeBuilder in both OPA policy-load paths (from_proto_with_pid, preprocess_yaml_data), matching existing L7 validation warning plumbing
• Add unit test for access: allow (warning emitted, rules not expanded)
• Assert warnings.is_empty() on existing supported-preset expansion tests
• Document access_preset_rules and expand_access_presets invariants

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[russellb]

🤖 Agent-assisted code review (principal-engineer pass). Verified locally: expand_* unit tests pass; traced the warning path.

Approve with minor suggestions — well-scoped, behavior-preserving. Actionable items:

1. OCSF emit block is now copy-pasted 4× in opa.rs (2 validation + 2 expansion, differing only in message prefix). This PR deepens existing duplication. Extract a helper and collapse all four sites:

   fn emit_l7_config_warnings(warnings: &[String], prefix: &str) {
       for w in warnings {
           ocsf_emit!(ConfigStateChangeBuilder::new(ctx::ctx())
               .severity(SeverityId::Medium)
               .status(StatusId::Success)
               .state(StateId::Enabled, "validated")
               .unmapped("warning", serde_json::json!(w))
               .message(format!("{prefix}: {w}"))
               .build());
       }
   }

2. Document access_preset_rules's implicit contract. Now that it's an independently-callable helper, its else branch silently returns REST rules for mcp/jsonrpc protocols — safe only because validate_l7_policies rejects access presets for those before expansion. Add a one-line doc comment stating that assumption so a future caller doesn't misuse it.

3. Nit: serde_json::json!(w.clone()) — w is &String; drop the clone (fold into #1).

Non-blocking design note: the unsupported-preset warning lives in expansion rather than validate_l7_policies (which already returns warnings). Current placement keeps access_preset_rules as the single source of truth for supported presets — reasonable, but worth a comment so nobody "consolidates" it into validation and reintroduces a drifting preset list.

[lunarwhite]

Thanks for your review @russellb. Incorporated all 4 suggestions: https://github.com/NVIDIA/OpenShell/compare/4c0029870a3f9cef2428d16547f63018ade3fde5..059c35caa41c2a7c3141439601548c2e13ba8342

[russellb]

Thanks for the updates! This lgtm.