feat: handle auth-filtered projections without dropping or stranding local files

[Ruari-Phipps]

Summary

The API filters projections per permission slice: a user without read access to a slice
gets a skeleton carrying only identity fields, with the substantive fields stripped. This
makes every resource type tolerate that shape, and keeps withheld resources as lightweight
mappings rather than half-built resources, so references to them still resolve to a name.

Motivation

Pulling as a restricted reader either crashed on a missing field or wrote out resources
built from a skeleton, corrupting them on the next push. Withheld resources also have to
survive in the status file: without them, every {{entity:...}}-style reference to a
resource the user cannot read renders as a raw id, and the file then looks locally
modified on every command.

Changes

• Every from_projection now detects an auth-filtered slice and either drops the resource
  or keeps it as an identity-only stub, instead of assuming fields are present.
• Withheld resources are separated out of the resource map into slim_resources, a list of
  ResourceMapping. They resolve references but are never iterated for a file, saved, or
  pushed. load_resources_from_projection and pull_resources return them alongside the
  resource map.
• ResourceMapping gained to_dict/from_dict, storing resource_type by its registered
  name so slim mappings persist in the status file. An unregistered type is dropped on read
  rather than raising.
• Slim resources are excluded from file_structure_info — they have no file on disk, so a
  baseline entry would make find_new_kept_deleted report them deleted on every run.
• pull_resources, pull_deployment_resources, pull_branch_resources,
  get_template_resources, get_remote_resources_by_name and _resolve_branch_fork_point
  all return their slim mappings alongside the resource map, and every caller was updated
  to match.
• Fixed multi-resource YAML deletions never reaching disk when an entire type is absent from
  the incoming projection. The deletions were batched into the file cache, which was then
  discarded when the pull returned. The leftover cache entry was also stamped with the file's
  pre-write mtime, so the staleness check treated it as fresh and every later read in the
  process saw a file state that was not on disk. Withheld types take this path, so a force
  pull had to be run twice before poly diff came back clean.

Test strategy

• Added/updated unit tests
• Manual CLI testing (poly <command>)
• Tested against a live Agent Studio project
• N/A (docs, config, or trivial change)

Checklist

• ruff check . and ruff format --check . pass
• pytest passes (1372 passed, 159 subtests)
• No breaking changes to the poly CLI interface (or migration path documented)
• Commit messages follow conventional commits

[github-actions]

Coverage Report

Base (main)	PR	Change
75.9%	76.5%	+0.6% ✅

Changed file coverage

File	Coverage	Change
poly/utils/decorators.py	62.5%	+33.3% ✅
poly/handlers/interface.py	62.9%	-0.1% ⚠️
poly/project.py	77.6%	+1.2% ✅
poly/resources/function.py	81.5%	+0.6% ✅
poly/resources/pronunciation.py	82.3%	-0.6% ⚠️
poly/resources/handoff.py	83.6%	+0.4% ✅
poly/resources/variant_attributes.py	84.3%	-1.3% ⚠️
poly/resources/transcript_correction.py	84.5%	-2.3% ⚠️
poly/resources/keyphrase_boosting.py	88.4%	-2.1% ⚠️
poly/resources/entities.py	88.4%	+1.0% ✅
poly/resources/agent_settings.py	88.8%	-1.2% ⚠️
poly/resources/phrase_filter.py	88.8%	-1.3% ⚠️
poly/resources/flows.py	89.1%	+0.2% ✅
poly/resources/languages.py	89.1%	+1.8% ✅
poly/resources/experimental_config.py	89.6%	-2.4% ⚠️
poly/resources/documents.py	90.4%	+0.6% ✅
poly/resources/asr_settings.py	90.5%	+0.5% ✅
poly/resources/resource.py	90.9%	+1.1% ✅
poly/resources/channel_settings.py	91.0%	+2.6% ✅
poly/resources/sms.py	91.1%	+3.0% ✅
poly/resources/api_integration.py	91.9%	-1.2% ⚠️
poly/resources/test_suite.py	93.2%	+0.1% ✅
poly/resources/translations.py	94.0%	-0.6% ⚠️
poly/resources/safety_filters.py	95.7%	+0.2% ✅
poly/utils/stub_gen.py	95.9%	+42.5% ✅
poly/resources/topic.py	96.5%	+0.3% ✅
poly/resources/variable.py	96.9%	+1.2% ✅