[digitalresistor]

Description

The preflight facade in the cli/src/stellar_engine/gcp/live.py module translated only the gRPC PermissionDenied and Unauthenticated classes into its access denied error. The api_core library maps an HTTP 403 to Forbidden and an HTTP 401 to Unauthorized, which are the parents of those classes, so a denial raised through a REST transport surfaced as a generic cloud error without the access denied remedy.

• The facade now matches the Forbidden and Unauthorized parent classes, which still cover the gRPC subclasses.
• Preflight checks report REST denials as access denied with the same remedy as gRPC denials.
• The Cloud Storage and REST calls that the upcoming guided deploy adds get the same translation.

Part of #306. No separate issue exists for this defect.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Deployment & Compliance Impact

• Applicable Regimes:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Moderate
  • FedRAMP High
  • DoD IL4
  • DoD IL5
  • General / All
• NIST 800-53r5 Controls: None. The change affects how the CLI reports a permission failure, not a control implementation.

Checklist

Code Quality & Reusability

• My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
• I have checked that no existing module or configuration in modules/ or fast/stages-aw/ can be leveraged for this change.
• My code follows the established naming conventions outlined in docs/naming-convention.md.

Documentation

• I have updated the README.md of the modified module or blueprint. No README describes the error classes, so no documentation changes.
• I have added/updated documentation for inputs (variables) and outputs. Not applicable to the CLI.

Security

• My change adheres to GCP security best practices and the principle of least privilege.
• I have ensured compliance with the targeted regime (FedRAMP Moderate, FedRAMP High, IL4, IL5, etc.).

Testing

• I have tested my changes locally.
• I have included details of my testing in this PR.

Testing Performed

• uv run pytest in cli/ passes with 881 tests, including the new cases that feed Forbidden, Unauthorized and from_http_status(401) and from_http_status(403) errors through the translation.
• uv run ruff format --check, uv run ruff check and uv run pyright pass in cli/.
• python3 tools/check_boilerplate.py cli passes from the repository root.
• Verified with the installed google-api-core that from_http_status(403) returns Forbidden and that PermissionDenied subclasses it.