Migrate off deprecated trait profile/status attributes

[laurenleach]

baton-sdk v0.20.6 moved profile, status, and created_at off the trait
messages onto attributes on Resource, deprecating the trait-level options and
getters. staticcheck flags every remaining call with SA1019, so verify / lint
is red on main.

This migrates the connector to the resource-level API:

• With{User,Group,Role,App}Profile -> WithResourceProfile
• WithStatus / WithDetailedStatus -> WithResourceStatus
• WithCreatedAt / WithSecretCreatedAt -> WithResourceCreatedAt
• trait GetProfile() / GetStatus() reads -> the equivalent read on the resource

The option type changes from a *TraitOption to a ResourceOption, so the calls
move out of the trait slice and into the variadic tail of the New*Resource call.
The two status enums are numerically identical, so the values map 1:1. Non-deprecated
trait data (login, aliases, emails, secret type/expiry) is untouched.

No behavioural change intended: the deprecated options already populated the
resource-level fields. golangci-lint run ./... reports 0 issues after this
change, and the package tests pass.

[github-actions]

Connector PR Review: Migrate off deprecated trait profile/status attributes

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 42c31d6e2250.
Review mode: full
View review run

Review Summary

Scanned the full PR diff (one file, pkg/connector/formal.go, +10/-11) for security and correctness. The change moves WithCreatedAt/WithStatus off the user trait and WithGroupProfile off the group trait to the resource-level WithResourceCreatedAt/WithResourceStatus/WithResourceProfile options. I verified against the vendored SDK that this is behaviour-preserving: NewUserResource/NewGroupResource append the trait option after the caller's resource options, and syncUserTraitToResource/syncGroupTraitToResource only mirror trait fields onto the resource when the resource-level field is unset, so the explicitly-set resource values are never overwritten; UserTrait_Status_STATUS_ENABLED and Status_RESOURCE_STATUS_ENABLED are both 1, so the enum swap is 1:1. No dependency manifest changes, and no resource type IDs, entitlement slugs, ID derivation, or parent hierarchy were touched, so no breaking-change gate applies and docs/connector.mdx needs no update. No new issues found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

No blocking issues found.