test(BA-5375): add RBAC registry completeness test

[fregataa]

Summary

• Extract the inline RBAC action registry list from factory.py into a shared rbac_registry.py module for testability
• Add TestRBACRegistryCompleteness tests that verify every concrete BaseRBACAction subclass is registered, with no duplicates and no non-subclass entries
• Ensures new RBAC action implementations (BA-5317~BA-5348) cannot be silently excluded from the get_entity_valid_operations() API response

Test plan

• pants test tests/unit/manager/actions/test_rbac_registry.py passes
• pants test tests/unit/manager/actions/test_rbac_session.py passes (existing tests unaffected)
• pants lint / pants fmt / pants check clean (only pre-existing processors.py mypy error)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Extracts the RBAC action registry into a dedicated module and adds a unit test to ensure all concrete BaseRBACAction implementations are registered so get_entity_valid_operations() can’t silently omit new actions.

Changes:

• Introduced a shared RBAC_ACTION_REGISTRY module for the permission controller wiring.
• Updated the service factory to use the shared registry instead of an inline list.
• Added completeness/uniqueness/type-safety tests for the RBAC registry.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/unit/manager/actions/test_rbac_registry.py	Adds tests to validate the RBAC registry is complete, has no duplicates, and contains only valid action subclasses.
src/ai/backend/manager/services/factory.py	Switches PermissionControllerService wiring to use the centralized RBAC registry.
src/ai/backend/manager/actions/action/rbac_registry.py	New canonical RBAC action registry module exported for reuse and testability.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

issubclass(cls, BaseRBACAction) will raise TypeError if an entry in RBAC_ACTION_REGISTRY is not a class/type (e.g., None, a function, etc.), which makes the test error out instead of reporting a clear assertion failure. Consider first checking isinstance(entry, type) (or catching TypeError) and then treating non-types as invalid registry entries so the failure message is actionable.

Suggested change

	for entry in RBAC_ACTION_REGISTRY:
	for entry in RBAC_ACTION_REGISTRY:
	if not isinstance(entry, type):
	non_subclasses.append(repr(entry))
	continue

[Copilot]

RBAC_ACTION_REGISTRY is a module-level constant but is defined as a mutable list. Since factory.create_services() passes this object through directly, any accidental mutation would affect all consumers (and could create hard-to-debug global state). Consider making it immutable (e.g., Final + tuple[...]) and type it as a Sequence[type[BaseRBACAction]]/tuple[...] to communicate intent and prevent mutation.