[air] Apply permissions to direct-run jobs and MLflow experiments

[caroline-db]

Changes

• Apply configured additive permission grants to both the submitted job and its MLflow experiment for direct AIR runs.
• Translate supported job permission levels to their MLflow equivalents and reject unsupported mappings before sending permission updates.
• Keep permission application best-effort so a successfully submitted workload is not reported as failed, while preserving existing validation and convert-to-DABs behavior.

Why

The Go AIR CLI accepted permission configuration for direct runs but did not apply it. This matches the Python AIR CLI behavior so configured principals receive access to both resources created for a run.

Tests

• Added unit coverage for experiment creation, permission-level mapping, principals, outgoing ACL payloads, and unsupported levels.
• Updated the AIR run-submit acceptance test to verify experiment creation and both permission PATCH requests.
• Manually tested the same configuration before and after the change. Before the change, the run submitted without propagating the grants. After the change, a test group received CAN_VIEW on the submitted job and CAN_READ on the MLflow experiment.
• Ran go test ./experimental/air/cmd, the focused AIR acceptance test, ./task fmt, ./task checks, ./task lint, and the forced full ./task test suite.

This PR was written with Codex.

[eng-dev-ecosystem-bot]

Integration test report

Commit: e5e2694

Run: 34638795861

	Env	🔄​flaky	💚​RECOVERED	✅​pass	🙈​skip	Time
💚​	aws linux		1	275	16	8:02
💚​	aws windows		1	277	14	6:03
🔄​	azure linux	1	1	273	16	8:07
💚​	azure windows		1	276	14	5:14
💚​	gcp linux		1	275	16	6:25
💚​	gcp windows		1	277	14	6:40

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🔄​	TestSyncIncrementalFileOverwritesFolder	✅​p	✅​p	🔄​f	✅​p	✅​p	✅​p

Top 3 slowest tests (at least 2 minutes):

duration	env	testname
5:36	gcp windows	TestAccept
3:59	aws windows	TestAccept
3:19	azure windows	TestAccept

[github-actions]

Approval status: pending

/acceptance/experimental/air/ - needs approval

4 files changed
Suggested: @ben-hansen-db
Also eligible: @vinchenzo-db, @maggiewang-db, @apeforest, @bfontain, @panchalhp-db, @pardis-beikzadeh-db

/experimental/air/ - needs approval

Files: experimental/air/cmd/runpermissions.go, experimental/air/cmd/runpermissions_test.go, experimental/air/cmd/runsubmit.go
Suggested: @ben-hansen-db
Also eligible: @vinchenzo-db, @maggiewang-db, @apeforest, @bfontain, @panchalhp-db, @pardis-beikzadeh-db

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose, @lennartkats-db, @rugpanov, @rclarey) can approve all areas.
See OWNERS for ownership rules.}