feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

2 files changed, 0 insertions, 44 deletions

diff --git a/vendor/rustix/src/backend/linux_raw/pty/mod.rs b/vendor/rustix/src/backend/linux_raw/pty/mod.rs
deleted file mode 100644
index ef944f04..00000000
--- a/vendor/rustix/src/backend/linux_raw/pty/mod.rs
+++ /dev/null
@@ -1 +0,0 @@
-pub(crate) mod syscalls;
diff --git a/vendor/rustix/src/backend/linux_raw/pty/syscalls.rs b/vendor/rustix/src/backend/linux_raw/pty/syscalls.rs
deleted file mode 100644
index b64344fb..00000000
--- a/vendor/rustix/src/backend/linux_raw/pty/syscalls.rs
+++ /dev/null
@@ -1,43 +0,0 @@
-//! linux_raw syscalls supporting `rustix::pty`.
-//!
-//! # Safety
-//!
-//! See the `rustix::backend` module documentation for details.
-#![allow(unsafe_code, clippy::undocumented_unsafe_blocks)]
-
-use crate::backend::conv::{by_ref, c_uint, ret};
-use crate::fd::BorrowedFd;
-use crate::io;
-use linux_raw_sys::ioctl::TIOCSPTLCK;
-#[cfg(feature = "alloc")]
-use {
-    crate::backend::c, crate::ffi::CString, crate::path::DecInt, alloc::vec::Vec,
-    core::mem::MaybeUninit, linux_raw_sys::ioctl::TIOCGPTN,
-};
-
-#[cfg(feature = "alloc")]
-#[inline]
-pub(crate) fn ptsname(fd: BorrowedFd<'_>, mut buffer: Vec<u8>) -> io::Result<CString> {
-    unsafe {
-        let mut n = MaybeUninit::<c::c_int>::uninit();
-        ret(syscall!(__NR_ioctl, fd, c_uint(TIOCGPTN), &mut n))?;
-
-        buffer.clear();
-        buffer.extend_from_slice(b"/dev/pts/");
-        buffer.extend_from_slice(DecInt::new(n.assume_init()).as_bytes());
-        buffer.push(b'\0');
-        Ok(CString::from_vec_with_nul_unchecked(buffer))
-    }
-}
-
-#[inline]
-pub(crate) fn unlockpt(fd: BorrowedFd<'_>) -> io::Result<()> {
-    unsafe {
-        ret(syscall_readonly!(
-            __NR_ioctl,
-            fd,
-            c_uint(TIOCSPTLCK),
-            by_ref(&0)
-        ))
-    }
-}