Migrate off deprecated trait profile/status attributes

[laurenleach]

baton-sdk v0.20.6 moved profile, status, and created_at off the trait
messages onto attributes on Resource, deprecating the trait-level options and
getters. staticcheck flags every remaining call with SA1019, so verify / lint
is red on main.

This migrates the connector to the resource-level API:

• With{User,Group,Role,App}Profile -> WithResourceProfile
• WithStatus / WithDetailedStatus -> WithResourceStatus
• WithCreatedAt / WithSecretCreatedAt -> WithResourceCreatedAt
• trait GetProfile() / GetStatus() reads -> the equivalent read on the resource

The option type changes from a *TraitOption to a ResourceOption, so the calls
move out of the trait slice and into the variadic tail of the New*Resource call.
The two status enums are numerically identical, so the values map 1:1. Non-deprecated
trait data (login, aliases, emails, secret type/expiry) is untouched.

No behavioural change intended: the deprecated options already populated the
resource-level fields. golangci-lint run ./... reports 0 issues after this
change, and the package tests pass.

[github-actions]

🟡 Suggestion: The migration itself is correct (WithResourceProfile/WithResourceCreatedAt run before the appended WithUserTrait, and syncUserTraitToResource only backfills unset resource fields, so behavior is unchanged). Now that the user trait slice is empty, it's visible that these user resources carry no login/email data even though v1.User exposes FullName and Identities — consider rs.WithUserLogin(user.Name, user.Identities...) to improve identity matching. Out of scope for this PR; non-blocking.

[github-actions]

Connector PR Review: Migrate off deprecated trait profile/status attributes

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 1cdec19f1b65.
Review mode: full
View review run

Review Summary

Scanned the full PR diff for security and correctness. The change is confined to pkg/client/convert.go and moves profile/created_at from the deprecated trait options into the resource-level variadic options for user, role, and group resources. I verified against vendored baton-sdk v0.22.0 that this is behavior-preserving: New{User,Group,Role}Resource appends With*Trait after the caller's ResourceOptions, and sync*TraitToResource only backfills resource fields that are not already set, so the resource-level values set here win and match what the deprecated path produced. A repo-wide grep confirms no remaining With{User,Group,Role,App}Profile, WithCreatedAt, WithStatus, WithDetailedStatus, WithSecretCreatedAt, or trait-level GetProfile()/GetStatus() callers; go.mod/go.sum are unchanged. No new issues found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• pkg/client/convert.go:48 — user resources now carry an empty trait slice and still have no login/email data, though v1.User exposes FullName and Identities (R9). Pre-existing gap, out of scope for this PR.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/client/convert.go`:
- Around line 48: `convertV1User2Resource` builds an empty `[]rs.UserTraitOption{}`, so the
  synced user resources have no login or email data. The OpenShift `v1.User` object exposes
  `FullName` and `Identities`. Consider populating the trait slice with
  `rs.WithUserLogin(user.Name, user.Identities...)` (and an email option if an email can be
  derived from the identities) so ConductorOne can match these users against other identity
  sources. This is a pre-existing gap rather than a regression from this PR, so treat it as
  optional follow-up work.

[github-actions]

No blocking issues found.