feat(native): sync owning team for services/functionalities and resolve kind: group fields

[kwent]

Summary

This PR is the CLI half of PRF-3452. Backstage users can now map spec.owner straight to the owning team of a service or functionality:

to: service            # or: functionality
map:
  owner_team: "{{ .spec.owner }}"      # e.g. group:default/sre
  responder:  { value: "{{ .team }}", kind: group }

• owner_team built-in (client.AttrOwnerTeam, gated by client.HasOwnerTeam), for services and functionalities.
  • It's sent as owner_group_ids: [id] on /v1/{services,functionalities}/bulk_upsert.
  • The live value is the record's owner_group_ids, comma-joined (setOwnerTeam), so plan/diff only shows a change when the owner actually differs.
  • rootly-go's bulk upsert types don't model owner_group_ids yet. withOwners injects it into the encoded body, and the request goes through Bulk*WithBodyWithResponse. Batches with no owners send the same bytes as before.
  • Backward compatible: if the resource type already has a custom property with slug owner_team, that property keeps syncing as a property. That case gets no team lookup, no owner_group_ids, and live owners aren't reported under owner_team. The check is in Client.OwnerTeamIsBuiltin / KnownAttrsWithProps.
• Team resolution (resolveTeamFields). It's called from resolveReferenceFields, so plan, sync and explain all get it.
  • The built-in owner_team and any kind: group field are resolved to a team ID by matching the team's ID, then external_id, then backstage_id, then name.
  • Teams are listed once per output, and only when one of these fields is configured.
  • An unknown team fails the plan with a clear error.
  • An empty owner_team is dropped, so the current owners stay unchanged.
  • An empty kind: group value is kept, so it tries to clear the live value. Today the API rejects blank values for every single-value custom property type with a 422.

Depends on rootlyhq/rootly#24148 (merged; in train-prod-2373), which makes the API accept owner_group_ids on services and functionalities bulk upsert.

Tests:

• Unit tests:
  • TestBulkUpsertNative_{Service,Functionality}OwnerTeam and TestBulkUpsertNative_OwnerTeamCustomProperty
  • Test{Service,Functionality}ToLive_OwnerTeam and TestServiceToLive_OwnerTeamCustomProperty
  • TestKnownAttrsWithProps
  • TestResolveReferenceFields_{Teams,UnknownTeam,FunctionalityOwnerTeam,OwnerTeamCustomProperty,OwnerTeamIgnoredOutsideServices}
• New integration step, Integration — native owner_team, in .github/workflows/integration.yaml. It runs on push to master and on workflow_dispatch, and fails if any of its status checks fail.
  • Uses two teams with Backstage-style external_ids.
  • Checks owner create, idempotent re-sync, a move from team A to team B (the plan must show 2 owner_team diffs), and that leaving owner_team unmapped keeps the owners.
  • It needs a working INTEGRATION_API_KEY.
• Local runtime validation against a Rootly API that includes #24148 passed; results are in the PR comment.

Link to Devin session: https://rootly.devinenterprise.com/sessions/ba7eaa797c98438bb7166d6f8a275fbd
Open in Devin Desktop: https://rootly.devinenterprise.com/desktop/session/ba7eaa797c98438bb7166d6f8a275fbd?variant=devin
Requested by: @kwent

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

👀 1 finding needs your review

Devin fixed 1 of 2 findings on 6cf486c. Click a finding below to jump to its comment.

For your review (1)

• Existing owner_team properties stop syncing

Fixed by Devin (1)

• Empty group mapping leaves stale membership

View all findings in Devin Review

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

Local runtime validation: PASS for the owner_team scope at fab1a75, run against a local Rootly API at 3a3f37b (rootly#24148). The only commit since then, f219b66, makes the owner_team integration step fail when a status check fails.

• The Integration — native owner_team script printed all six ✓ lines. Separate GETs confirmed the owners of both the service and the functionality went A → B, then stayed B when owner_team was omitted.
• Custom owner_team property collision: a functionality TEXT property with slug owner_team kept the value "Platform notes" as a property. No team lookup ran and no owner_group_ids was sent, owners stayed B, and a re-sync showed no drift.
• Checked on 230791f and not re-run on this revision:
  • unknown-team plans fail with no writes;
  • name and UUID resolution work;
  • an empty owner keeps the current owners;
  • [] clears owners;
  • a group from another org returns a 422.

Native ownership	Property collision

Limitations

• The API can't clear a single-value custom property with an empty value: it returns 422 Value can't be blank. A plain-text property gave the same 422 as kind: group, so this limitation predates feat(native): sync owning team for services/functionalities and resolve kind: group fields #25 and affects every custom property type.
• No hosted CI integration run yet: that job only runs on push to master and needs a working INTEGRATION_API_KEY.

Written by Devin