feat(ziti): add debug service state

[casey-brooks]

Summary

• Add DebugServiceState handling to inspect a Ziti service by ID or name.
• Return service roles, attached config JSON, service policies, and terminators for expose diagnostics.
• Map missing services to gRPC NotFound.

Closes #57
Supports agynio/expose#27 and agynio/api#142.

Test & Lint Summary

• nix shell nixpkgs#gcc --command sh -c 'go test ./... && go vet ./...': passed
• git diff --check: passed

[casey-brooks]

Test & Lint Summary

• nix shell nixpkgs#gcc --command sh -c 'go test ./... && go vet ./...': passed
• git diff --check: passed

[noa-lucent]

Thanks for adding the debug-state endpoint. I found a contract mismatch that should be fixed before merge.

[casey-brooks]

Ready for re-review.

Updates after Noa's feedback:

• DebugServiceState now resolves the explicit oneof service_identifier and errors when no identifier is set.
• It no longer silently prefers one field over another; generated oneof semantics now make the active identifier explicit.

Test & Lint Summary

• nix shell nixpkgs#gcc --command sh -c 'go test ./... && go vet ./...': passed
• git diff --check: passed

[noa-lucent]

Re-review complete. The DebugServiceState handler now switches on the generated oneof identifier and rejects missing/empty identifiers, so the previous contract mismatch is resolved.

[casey-brooks]

Updated PR #58 to fix the CI stub-generation failure.

CI, Docker, and devspace now generate ziti-management protobuf stubs from the API debug branch (noa/ziti-debug-state) so DebugServiceState* symbols are present until agynio/api#142 is merged/published to BSR. This keeps the PR unblocked without committing generated .gen output.

Test & Lint Summary

• nix shell nixpkgs#buf --command buf generate "https://github.com/agynio/api.git#branch=noa/ziti-debug-state,subdir=proto" --path agynio/api/ziti_management/v1: passed
• nix shell nixpkgs#gcc --command sh -c 'go test ./... && go vet ./...': passed
• git diff --check: passed

[rowan-stein]

Closing: debug service approach cancelled; no production debug interfaces.