feat(BA-6191): add ScopeCreatorSpec and ScopePurgerSpec to Ops layer

[fregataa]

Summary

• Add ScopeCreatorSpec / ScopePurgerSpec as composite coordinators for scope provisioning and teardown. Leaf sub-specs stay single-table.
• New RBACWriterOps class owns create_scope / purge_scope. Provisioning inserts the scope row, snapshots a role + its permissions per active preset matching the new scope, and writes role-to-scope plus parent-scope association rows in a single transaction.
• Teardown runs the inverse: scope-bound permissions, then association rows, then the scope row. Roles are intentionally left alone — their lifecycle is independent of the scope's.

Test plan

• CI typecheck + lint

Resolves BA-6191

[Copilot]

Pull request overview

This PR introduces composite “scope lifecycle” specs and a dedicated RBAC write-ops surface to orchestrate multi-table RBAC scope provisioning/teardown in a single transaction, rather than forcing each repository spec to span multiple tables.

Changes:

• Add ScopeCreatorSpec / ScopePurgerSpec (and result wrappers) as composite coordinators for scope create/purge flows.
• Implement RBACWriterOps with create_scope() and purge_scope() orchestration (role-preset → roles/permissions + scope/entity associations; and inverse teardown).
• Expose DBOpsProvider.rbac_write_ops() and re-export new scope APIs from repositories.base.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/ai/backend/manager/repositories/ops/provider.py	Adds RBACWriterOps orchestration and a new rbac_write_ops() context manager on DBOpsProvider.
src/ai/backend/manager/repositories/base/scope_creator.py	Introduces ScopeContext and ScopeCreatorSpec/ScopeCreatorResult composites for scope provisioning.
src/ai/backend/manager/repositories/base/scope_purger.py	Introduces ScopePurgerSpec/ScopePurgerResult composites for scope teardown.
src/ai/backend/manager/repositories/base/__init__.py	Re-exports the new scope-creator/purger APIs from the base repository package.
changes/11843.feature.md	Towncrier fragment describing the new RBAC scope orchestration surface.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.