Repair main golangci-lint SA1019 baseline (trait-profile deprecations)

[c1-squire-dev]

What & why

main's verify / lint job has been red since the 2026-07-21 dependency bump
(last green run 2026-07-21T11:27:49Z; the following chore: update dependency & Go versions commit turned it red). The bump shipped a baton-sdk that deprecates
the trait-level profile / status / icon / created_at options — the data
moved from the individual traits to canonical attributes on Resource. golangci-lint
v2.11.4 (the version the reusable verify workflow installs) reports exactly
15 SA1019 findings across trait-profile call sites that this PR does not
otherwise change.

This is a standalone prerequisite that repairs that baseline. It contains no
feature work.

Baseline (pristine main, CI-exact golangci-lint v2.11.4 → 15 issues)

File:Line	Deprecated symbol	Replacement
api_token.go:30	WithSecretCreatedAt	WithResourceCreatedAt
app.go:42	WithAppProfile	WithResourceProfile
app_test.go:41,44	app.GetProfile (read)	resourceSdk.GetProfile(resource)
invitation.go:67	WithUserProfile	WithResourceProfile
invitation.go:68	WithStatus	kept — see note
invitation_test.go:260,261	ut.Profile (read)	resourceSdk.GetProfile(r)
org_role.go:57	WithRoleProfile	WithResourceProfile
team.go:48	WithGroupProfile	WithResourceProfile
team.go:167,288	teamTrait.Profile / groupTrait.Profile (read)	rType.GetProfile(resource)
user.go:51,52,60	WithUserProfile / WithStatus / WithUserIcon	WithResourceProfile / WithResourceStatus / WithResourceIcon

Approach — smallest behavior-preserving migration

• Producers → resource-level options. The SDK's deprecated trait options wrote the
  field both on the trait and (via a sync helper) on the resource; the new options
  write the resource-level attribute directly. Values are identical — profile/icon/
  created_at simply move to their canonical, non-deprecated home. Each resource still
  carries its trait annotation (WithAppTrait() / empty trait-option slices), so
  GetAppTrait/GetUserTrait/etc. still resolve.
• Reads → GetProfile. Both the production reads in team.go (org-ID lookup for
  team grants) and the test reads now use the SDK's fallback-aware
  GetProfile(resource) (resource-level first, trait fallback for older data), so the
  connector's own write/read path stays consistent.
• user status is drift-free. WithResourceStatus(RESOURCE_STATUS_ENABLED) sets
  the resource status; NewUserTrait still defaults the unset trait status to ENABLED,
  so both levels match the previous output exactly.
• Invitation status is deliberately not migrated. An invitation is a pending/
  expired user that must not be reported as enabled. WithResourceStatus cannot
  express this: dropping the trait option would let NewUserTrait force the trait
  status to ENABLED, flipping the emitted status from UNSPECIFIED to ENABLED. The
  line keeps WithStatus(UNSPECIFIED) under a targeted, explained
  //nolint:staticcheck (the same backward-compat pattern the SDK itself uses),
  preserving UNSPECIFIED on both the trait and the mirrored resource level.

The repository.go:158 G115 gosec finding some local golangci-lint versions emit is
not part of this baseline — CI's v2.11.4 does not report it, it is not SA1019, and
it is not from the dependency bump. It is left untouched.

Verification

• Lint: CI-exact golangci-lint v2.11.4 → 0 issues on this branch (was 15 on main).
• Tests: go test ./... -count=1 green; go test -race ./pkg/connector/ -count=1 green, no race warnings.
• Build / generate: go build ./... and make build (runs go generate ./pkg/config) clean; no generated-file drift.
• No output drift: every resource keeps its trait; profile/icon/created_at values are
  identical, relocated to the Resource-level attributes the SDK now reads; status preserved
  on both levels (ENABLED for users, UNSPECIFIED for invitations).

Relationship to #180

PR #180 (delete-marker idempotency) adds zero new lint issues but cannot go fully
green while main's lint baseline is red. This PR is the prerequisite that makes main
lint-green. #180 should rebase onto main after this merges — no changes to #180's
branch or semantics are needed or included here.

---

🤖 Generated with Claude Code

[github-actions]

Connector PR Review: Repair main golangci-lint SA1019 baseline (trait-profile deprecations)

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 7b8e75696a7d.
Review mode: full
View review run

Review Summary

Full PR diff scanned for security and correctness. This PR migrates deprecated trait-level profile/status/icon/created_at options to their canonical Resource-level equivalents (WithResourceProfile/WithResourceStatus/WithResourceIcon/WithResourceCreatedAt) to clear 15 SA1019 lint findings. I verified against the vendored SDK that the migration is behavior-preserving: GetProfile reads the resource-level value first with a trait-level fallback (matching the new writes), user status stays ENABLED on both levels (explicit + NewUserTrait default), and the invitation's UNSPECIFIED status is correctly preserved via the retained, explained //nolint:staticcheck on WithStatus. No new issues found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

No blocking issues found.