Add trusted role administration compatibility

Why: Existing RDM role commands must reach the Backend authority during UI and migration cutover without dual-writing RDM role tables.

Evidence: The full Backend suite passed, including actor-bound role administration, owner compatibility, provider, and public-surface tests.

Impact: Adds temporary trusted Host administration methods and completes the project-action catalog used by RDM.

Refs: Focused role and permission system task 5

pkg/extension/role_policy.go

@@ -40,5 +40,34 @@ type RoleActionDecision struct {
 type RolePolicyProvider interface {
 	CurrentRolePolicy(context.Context) (RolePolicySnapshot, error)
 	RolePolicyForUser(context.Context, string) (RolePolicySnapshot, error)
+	RolePolicyForOwner(context.Context, string) (RolePolicySnapshot, error)
 	CheckRoleAction(context.Context, string, string) (RoleActionDecision, error)
 }
+
+type RoleAdminRecord struct {
+	RoleID       string                    `json:"roleId"`
+	Name         string                    `json:"name"`
+	Description  string                    `json:"description"`
+	Enabled      bool                      `json:"enabled"`
+	RoleVersion  int64                     `json:"roleVersion"`
+	BindingCount int                       `json:"bindingCount"`
+	Permissions  map[string]RolePermission `json:"permissions"`
+}
+
+type RoleBindingResult struct {
+	BindingID        string `json:"bindingId"`
+	UserID           string `json:"userId"`
+	RoleID           string `json:"roleId"`
+	UserStateVersion int64  `json:"userStateVersion"`
+	AuthorityEpoch   int64  `json:"authorityEpoch"`
+}
+
+// RolePolicyAdmin is a temporary compatibility surface for trusted RDM
+// commands while the UI moves to Backend HTTP APIs. The Host binds the actor.
+type RolePolicyAdmin interface {
+	ListRoles(context.Context) ([]RoleAdminRecord, error)
+	CreateRole(context.Context, string, string) (RoleAdminRecord, error)
+	SetRolePermission(context.Context, string, string, bool, bool, string) (RoleAdminRecord, error)
+	AssignRoleByOwner(context.Context, string, string, string) (RoleBindingResult, error)
+	SetRoleEnabled(context.Context, string, bool) (RoleAdminRecord, error)
+}

pkg/extension/surface.txt

@@ -80,10 +80,19 @@ ResourceAuthorizer
 ResourceAuthorizerV2
 ResourceAuthzQuery
 RoleActionDecision
+RoleAdminRecord
+RoleBindingResult
 RolePermission
+RolePolicyAdmin
+RolePolicyAdmin.AssignRoleByOwner
+RolePolicyAdmin.CreateRole
+RolePolicyAdmin.ListRoles
+RolePolicyAdmin.SetRoleEnabled
+RolePolicyAdmin.SetRolePermission
 RolePolicyProvider
 RolePolicyProvider.CheckRoleAction
 RolePolicyProvider.CurrentRolePolicy
+RolePolicyProvider.RolePolicyForOwner
 RolePolicyProvider.RolePolicyForUser
 RolePolicySchemaVersion
 RolePolicySnapshot