Unseeded singleton global AccessPolicy causes "kubectl ate get/update access-policy --global" to fail or print plain text on fresh clusters #3294

Summary & Root Cause

The global policy is modeled as a singleton that cannot be deleted, but nothing creates it. The initial migration makes an empty table, and only an explicit CreateGlobalAccessPolicy inserts the row. On a fresh install where access comes only from --authz-bootstrap-owners:

• get --global gets NotFound, prints a plain-text notice on stderr and exits 0, even with -o yaml.
• update --global either fails client-side (no uid/version, which the user cannot obtain because get -o yaml printed nothing), or fails server-side with NotFound.
• Both hints name commands without --global. The second hint would create an atespace policy, or fail flag validation, instead of the global one.

Affected Code Locations

• cmd/ateapi/internal/store/atepg/migrations/000001_initial.sql:204-210: global_access_policy is a singleton table (id boolean PRIMARY KEY DEFAULT true CHECK (id)). The migration inserts no row.
• cmd/ateapi/internal/store/atepg/access_policy.go:29-59: CreateGlobalAccessPolicy is the only INSERT INTO global_access_policy (line 44).
• cmd/ateapi/internal/store/atepg/access_policy.go:61-65: GetGlobalAccessPolicy selects WHERE id = true.
• cmd/ateapi/internal/store/atepg/access_policy.go:67-110: UpdateGlobalAccessPolicy does SELECT ... FOR UPDATE (lines 78-83) and returns ErrNotFound when no row exists.
• cmd/ateapi/internal/controlapi/access_policy.go:56-61: maps that error to NotFound("Global AccessPolicy not found").
• cmd/kubectl-ate/internal/cmd/access_policy.go:217-223: on NotFound, get writes "%s has no access policy" to stderr and returns nil (RC 0), regardless of -o yaml.
• cmd/kubectl-ate/internal/cmd/access_policy.go:341-344: update refuses a manifest without metadata.uid/metadata.version and points at "get access-policy -o yaml", with no --global.
• cmd/kubectl-ate/internal/cmd/access_policy.go:256-260: on NotFound, update says create it with "kubectl ate create access-policy", again without --global.
• docs/authorization.md:254-266: the example commands are atespace-only (-a team-a). Line 266 says "The global policy can't be deleted". Nothing says the global policy must be created once first.

Detailed Reproduction Guide

1. On a freshly installed cluster where no create access-policy --global has ever run:

kubectl ate get access-policy --global -o yaml
kubectl ate update access-policy --global -f global-pol-nouid.yaml
kubectl ate update access-policy --global -f global-pol-uid.yaml

The two manifests:

# global-pol-nouid.yaml
metadata:
  name: default
bindings:
- role: viewer
  members:
  - user:carol@example.com

# global-pol-uid.yaml
metadata:
  name: default
  uid: 00000000-0000-0000-0000-000000000001
  version: "1"
bindings:
- role: viewer
  members:
  - user:carol@example.com

Expected vs. Actual Behavior

• Expected: One of the following:
  • An empty global AccessPolicy row is seeded at database init or server startup, so get --global -o yaml prints YAML with uid/version and update --global works out of the box.
  • get --global -o yaml exits non-zero or prints an empty YAML document, and every hint includes --global, for example create it with "kubectl ate create access-policy --global".
• Actual:
  1. get access-policy --global -o yaml prints global has no access policy (RC=0) instead of YAML.
  2. update --global without uid fails with lacks the metadata.uid and metadata.version preconditions that "get access-policy -o yaml" prints.
  3. update --global with a uid fails with global has no access policy to update; create it with "kubectl ate create access-policy". The hint omits --global.

Observed Output & Logs

$ kubectl ate get access-policy --global -o yaml
global has no access policy
RC=0
$ kubectl ate update access-policy --global -f global-pol-nouid.yaml
Error: manifest for the global access policy lacks the metadata.uid and metadata.version preconditions that "get access-policy -o yaml" prints
RC=1
$ kubectl ate update access-policy --global -f global-pol-uid.yaml
Error: global has no access policy to update; create it with "kubectl ate create access-policy"
RC=1

$ kubectl ate get access-policy --global
global has no access policy
RC=0
$ kubectl ate get access-policy --global -o yaml
global has no access policy
RC=0
$ kubectl ate update access-policy --global -f global-pol-nouid.yaml
Error: manifest for the global access policy lacks the metadata.uid and metadata.version preconditions that "get access-policy -o yaml" prints
RC=1
$ kubectl ate update access-policy --global -f global-pol-uid.yaml
Error: global has no access policy to update; create it with "kubectl ate create access-policy"
RC=1