test: cover user aggregate API routing and recent schema sync contracts

[cursor]

Description

Regression test coverage for recently merged production changes with meaningful business risk and no dedicated tests.

Risky behavior now covered

1. User get aggregate API (fix: route user get through the aggregate API #876) — GET /ng/api/user/{userId} returns 405 on ng-manager (surfaced as 500). The fix routes through GET /ng/api/user/aggregate/{userId}. Tests lock the endpoint spec and registry.dispatch path so a revert re-breaks user lookups.

2. HttpStepInfo authentication conditionals (chore: auto-sync harness schemas #869) — Schema sync added if/then required-field branches for Basic, BearerToken, and ApiKey auth types. Contract tests assert each branch requires the correct spec fields in v0 pipeline and template bundles.

3. UnifiedStageNodeV1 permissions (chore: auto-sync harness schemas #864) — v1 pipeline/template stages gained a permissions object for scoped stage RBAC. Contract tests assert the field exists with the expected description.

4. Istio-only K8s traffic routing (chore: auto-sync harness schemas #874) — Upstream removed SMI provider support and consolidated IstioProviderSpec (gateways/hosts/delegateService). Contract tests assert istio is the sole provider enum value and SMI/rootService are absent.

Test files added/updated

• Added: tests/registry/access-control.test.ts (11 tests)
• Updated: tests/schemas/schema-bundle-contract.test.ts (+3 contract tests)

Why these tests materially reduce regression risk

• User aggregate routing is a silent production failure — agents calling harness_get(resource_type="user") would hit a disallowed endpoint without these guards.
• Schema bundle contracts catch auto-sync regressions before agents build invalid pipeline YAML from stale or truncated schema definitions.
• All tests are deterministic, mock-based, and independent of Harness credentials.

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other — regression test coverage

Checklist

• pnpm test passes (28/28 targeted tests)
• pnpm typecheck passes
• pnpm build passes
• pnpm standards:check passes
• pnpm docs:check passes

Validation

pnpm test tests/registry/access-control.test.ts tests/schemas/schema-bundle-contract.test.ts
# 28 passed