feat(velocity): bundle permissions REST client

[lusu007]

Pull Request

Description

Moves the Velocity base image to the REST-only permissions plugin.

• Pins plugin-permissions-velocity to 0.7.0.
• Adds a Docker build-time JAR contract that requires the REST client and rejects embedded gRPC or Protobuf transport classes.
• Documents the PERMISSIONS_SERVICE_URL and PERMISSIONS_TOKEN_FILE runtime contract.

This image must be released before the platform bundle switches permissions consumers away from gRPC.

Type of Change

• 🐛 Bug fix
• ✨ New feature
• 💥 Breaking change
• ♻️ Refactoring
• 📚 Documentation
• 🔧 Chore

Related Issues

• None

Testing

• Unit tests pass
• Manual testing completed
• New tests added for new functionality
• Built the Velocity image with the GitHub Packages token supplied as a BuildKit secret
• Verified the embedded plugin-permissions-velocity JAR contains the REST client
• Verified the embedded JAR contains no gRPC or Protobuf transport classes
• Shell syntax and whitespace checks pass

Checklist

• I have performed a self-review of my own code
• Tests have been added/updated and pass (if needed)
• Documentation has been updated (if needed)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f05ff13505

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Skip verification when permissions is not requested

When a caller uses the documented PLUGINS build argument to omit plugin-permissions-velocity (including setting it to an empty string), the download step never creates this JAR, but this unconditional verifier invocation exits with missing_rest_client, causing an otherwise valid customized image build to fail. Guard verification on the artifact being requested/present, or download the mandatory permissions plugin independently of the customizable list.

Useful? React with 👍 / 👎.