Migrate off deprecated trait profile/status attributes

[laurenleach]

baton-sdk v0.20.6 moved profile, status, and created_at off the trait
messages onto attributes on Resource, deprecating the trait-level options and
getters. staticcheck flags every remaining call with SA1019, so verify / lint
is red on main.

This migrates the connector to the resource-level API:

• With{User,Group,Role,App}Profile -> WithResourceProfile
• WithStatus / WithDetailedStatus -> WithResourceStatus
• WithCreatedAt / WithSecretCreatedAt -> WithResourceCreatedAt
• trait GetProfile() / GetStatus() reads -> the equivalent read on the resource

The option type changes from a *TraitOption to a ResourceOption, so the calls
move out of the trait slice and into the variadic tail of the New*Resource call.
The two status enums are numerically identical, so the values map 1:1. Non-deprecated
trait data (login, aliases, emails, secret type/expiry) is untouched.

No behavioural change intended: the deprecated options already populated the
resource-level fields. golangci-lint run ./... reports 0 issues after this
change, and the package tests pass.

[github-actions]

🟡 Suggestion (medium confidence): the enum cast is correct today — UserTrait_Status_Status and Status_ResourceStatus are both 0/1/2/3 for UNSPECIFIED/ENABLED/DISABLED/DELETED, and the SDK does the same cast internally in syncUserTraitToResource. But keeping userStatus typed as the deprecated v2.UserTrait_Status_Status means the connector still depends on the deprecated enum and needs a numeric cross-enum cast that would silently break if the two enums ever diverge. Consider declaring userStatus as v2.Status_ResourceStatus and assigning v2.Status_RESOURCE_STATUS_ENABLED / v2.Status_RESOURCE_STATUS_DISABLED in the switch, then passing it directly. Same applies at line 92 in agentResource.

[github-actions]

Connector PR Review: Migrate off deprecated trait profile/status attributes

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 9654115acb91.
Review mode: full
View review run

Review Summary

Scanned the full PR diff (single file, pkg/connector/helper.go) for security and correctness. The migration is faithful: WithResourceProfile / WithResourceStatus are ResourceOptions that run before the WithUserTrait/WithGroupTrait/WithRoleTrait option the New*Resource helpers append last, and the SDK's sync*TraitToResource mirrors only fill unset fields (!r.HasProfile()), so there is no overwrite; the group/role trait annotations are still emitted even with now-empty option slices. The two status enums are verified identical in the vendored protos (UNSPECIFIED/ENABLED/DISABLED/DELETED = 0/1/2/3), so the cast is value-preserving, and go.mod (baton-sdk v0.22.0) and vendor/ are unchanged, with WithResourceProfile/WithResourceStatus already present in the vendored SDK. No remaining deprecated trait profile/status call sites exist in pkg/, and the only trait read left in the connector (ticket.go ut.Login) is unaffected.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• pkg/connector/helper.go:48 (also :92) — userStatus stays typed as the deprecated v2.UserTrait_Status_Status and is numerically cast to v2.Status_ResourceStatus; declaring it as v2.Status_ResourceStatus directly would drop the last dependency on the deprecated enum and the cross-enum cast.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/connector/helper.go`:
- Around lines 15-30 and 48 (requesterUserResource) and lines 58-73 and 92
  (agentResource): the local `userStatus` variable is still declared with the
  deprecated enum type `v2.UserTrait_Status_Status` and is then numerically
  converted at the call site via `v2.Status_ResourceStatus(userStatus)`. The
  values happen to line up today (UNSPECIFIED/ENABLED/DISABLED/DELETED =
  0/1/2/3 in both enums), so this is not a bug, but it keeps a dependency on
  the deprecated enum and a cast that would silently produce a wrong status if
  the enums ever diverge. Change the declaration to
  `userStatus := v2.Status_RESOURCE_STATUS_ENABLED` (type
  `v2.Status_ResourceStatus`), set `v2.Status_RESOURCE_STATUS_ENABLED` /
  `v2.Status_RESOURCE_STATUS_DISABLED` in the `switch user.Active` block, and
  pass `userStatus` to `rs.WithResourceStatus(userStatus, "")` without a cast.

[github-actions]

No blocking issues found.