Add proboctl merge-manual-into-scim command

[SachaProbo]

Add a proboctl membership-profile merge-manual-into-scim command that, for one organization, repoints every reference (ownership, task assignment, signatures, approvals, etc.) from each MANUAL membership profile onto the matching SCIM profile.

A manual profile is merged only when its normalized full name maps to exactly one SCIM profile that is a real IAM member and predates it. The repoint runs as a single statement of data-modifying CTEs: no rows are deleted, and any constraint violation fails the whole statement. --dry-run prints the mapping and --yes gates the write.

---

Summary by cubic

Adds proboctl membership-profile merge-manual-into-scim to repoint MANUAL profiles to their unique SCIM match for one org. Runs as a single-statement merge with a preflight that shows mappings, per-target move/skip counts, and collisions; supports --dry-run and --yes.

proboctl +725 -0

• Adds membership-profile group and merge-manual-into-scim; registered in proboctl root.
• Match: normalized full name maps to exactly one SCIM profile and both are IAM members; creation order ignored.
• Repoints in one statement across owners, tasks, approvals, signatures, third parties, processing, and findings.
• Unique slots (default approvers, approval decisions, signatures): repoint the top row; leave duplicate-prone manual rows untouched; report moved/skipped totals.
• Preflight prints org, mapping, counts, and collision details; --dry-run prints only; --yes applies and prints per-target results; constraint failures surface the violated constraint name.

^{Written for commit 2c063a3. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/proboctl/membershipprofile/merge_manual_into_scim.go">

<violation number="1" location="pkg/proboctl/membershipprofile/merge_manual_into_scim.go:58">
P1: The merge can select the opposite profile pair from the documented rule: `m.created_at < s.created_at` requires the MANUAL profile to be older, not the SCIM profile. Consider reversing the predicate in both `previewSQL` and `mergeSQL` so dry-run and write use the same intended eligibility check.</violation>

<violation number="2" location="pkg/proboctl/membershipprofile/merge_manual_into_scim.go:96">
P1: This merge leaves several profile-backed foreign keys untouched, so it does not actually repoint every MANUAL membership profile reference. Rows in `documents`, `document_versions`, `meeting_attendees`, `nonconformities`, `states_of_applicability`, and `vendors` can still keep the old MANUAL profile IDs after the command completes.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>