Fix build after grants and config-profile merge

[chrisghill]

#252 (config profiles) and #253 (repo/resource grants) merged cleanly as text but not as code. #252 introduced newMassdriverClient(cmd) in cmd/client.go, which resolves the --profile flag, and converted every call site in the files it touched. The grant commands landed afterward still calling massdriver.NewClient() directly.

Why only one file failed the build

cmd/resource.go no longer imports massdriver — #252 removed it once its own call sites were converted — so the three grant calls failed with undefined: massdriver.

cmd/repository.go kept the import, because createOciRepoCommon uses *massdriver.Client as a parameter type. It compiled, and its three grant commands silently ignored --profile. That one would have shipped unnoticed.

Changes

• All six grant call sites now go through newMassdriverClient(cmd).
• runRepositoryGrantCreate and runResourceGrantCreate take cmd *cobra.Command as their first parameter, matching how Add mass config for managing CLI profiles (SDK v0.3.3) #252 threaded it into runRepositoryList. The list and delete runners already had it.
• Regenerated the eight docs/generated/mass_*_grant*.md pages. They were produced before --profile existed and were missing its "Options inherited from parent commands" section.

Verification

make check passes. Confirmed the flag is wired rather than merely compiling — mass repository grant create <name> --all-projects --profile no-such-profile now fails with profile not found, where before it accepted and ignored the flag. Exercised create, list, and delete against a live organization on a throwaway repository, then removed it.

Not included

cmd/config.go carries seven inline cobra Example fields. #252 predates the sweep in #253 that moved all other examples into docs/helpdocs, so the convention is inconsistent again. Converting them means authoring seven new helpdocs, which belongs in its own PR.

[chrisghill]

@claude review

[claude]

Claude finished @chrisghill's task in 59s —— View job

---

Review complete

• Gather context (PR diff, CLAUDE.md guidelines)
• Understand the request (code review of PR Fix build after grants and config-profile merge #254)
• Review cmd/repository.go and cmd/resource.go changes
• Review regenerated docs
• Post final review feedback

Summary: This is a clean, minimal fix that does exactly what the description says.

• Verified all six grant call sites (repository grant create/list/delete, resource grant create/list/delete) now route through newMassdriverClient(cmd) — confirmed via grep that no massdriver.NewClient() calls remain anywhere in cmd/.
• runRepositoryGrantCreate / runResourceGrantCreate signatures now take cmd *cobra.Command as the first parameter, and both have exactly one call site each (in the RunE closures), so there's no signature/call-site drift.
• This is consistent with newMassdriverClient in cmd/client.go, which correctly delegates profile resolution to the SDK via massdriver.WithProfile(profile) — in line with this repo's CLAUDE.md rule that the SDK is the sole authority on config/profile resolution.
• Spot-checked the regenerated docs (mass_repository_grant*.md, mass_resource_grant*.md): the added "Options inherited from parent commands" block matches the exact format already used in other generated docs (e.g. mass_repository_list.md), so the docs are consistent with the rest of the generated set.
• cmd/ has no test files, per CLAUDE.md, so no tests were expected here — this is purely wiring-layer glue, which is the right place for it.
• Scope is appropriately narrow: the PR explicitly and correctly defers the cmd/config.go inline-Example cleanup to a separate PR rather than scope-creeping it in here.

No bugs, correctness issues, or style concerns found. I was not able to run go build/make check myself in this sandboxed review session (build commands require approval that wasn't available), but the diff is small and self-consistent enough that I'm confident in the analysis above based on static review. The PR author's description states make check passes and the flag behavior was manually verified against a live org, which is consistent with what the diff shows.

This looks good to merge as-is.