fix(ci): deploy Tinybird Forward resource token scopes

[isuttell]

Summary

Production delivery provisioning failed with HTTP 403 because Tinybird Forward manages resource-scoped tokens through datafile deployment. The workflow attempted to create those tokens through the Token API.

Declare all 41 permissions for the three Worker tokens in the generated deployment tree. Preserve legacy datasource definitions while adding the exact append-token directive. Repeated expansion accepts existing identical declarations. The provisioning step now reads deployed tokens, verifies exact scopes, and exports them without API mutations.

Validation

• Full local CI: 68/68 tasks passed.
• Focused token/workflow tests: 48/48 passed; production-ref, main-ref, HEAD^, repeated-expand, and switch preservation checks passed.
• Tinybird contracts, formatting, lint, type-check, and Bash syntax passed.
• Read-only production cloud check using the actual WORKSPACE:DEPLOY credential and deployed reader ref 844d8f03: valid, exactly three tokens created with 41 added scopes, no removed permissions or resource deletions.
• Independent review approved exact head 5790fe4d14294ebcd42bd25d367c27042d64be42 with no findings. Current-head hosted CI passed.

Risk

HIGH: production schema deployment and credential provisioning. The existing operator and deploy credentials stay separate. No runtime permission is broadened beyond the previously reviewed three token definitions. Cloud apply is performed by Actions after merge.

TRA-276. Follows #531 and #532.

Tinybird Forward resource-token contract.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: fa1f7eb4-0123-4884-b278-7ac092436d05

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[isuttell]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5790fe4. Configure here.}