feat(release): disclose module permissions in catalog

tests/test_release_catalog_entry_synthesis.py

@@ -5,7 +5,7 @@ import tomllib
 import unittest
 from pathlib import Path
 
-from govoplan_core.core.modules import ModuleManifest
+from govoplan_core.core.modules import ModuleManifest, PermissionDefinition
 from govoplan_core.core.provider_governance import (
     ExternalProviderDeclaration,
     ModuleArchitectureDeclaration,
@@ -88,6 +88,18 @@ class ReleaseCatalogEntrySynthesisTests(unittest.TestCase):
                 id="example",
                 name="Example",
                 version="1.2.3",
+                permissions=(
+                    PermissionDefinition(
+                        scope="example:records:read",
+                        label="Read records",
+                        description="Read example records.",
+                        category="Records",
+                        level="tenant",
+                        module_id="example",
+                        resource="records",
+                        action="read",
+                    ),
+                ),
                 architecture=architecture,
                 external_providers=(provider,),
             ),
@@ -112,6 +124,19 @@ class ReleaseCatalogEntrySynthesisTests(unittest.TestCase):
                 "default_authority_mode"
             ],
         )
+        self.assertEqual(
+            {
+                "scope": "example:records:read",
+                "label": "Read records",
+                "description": "Read example records.",
+                "category": "Records",
+                "level": "tenant",
+                "resource": "records",
+                "action": "read",
+                "deprecated": False,
+            },
+            entry["permissions"][0],
+        )
 
     def test_selective_update_synthesizes_initial_entries_from_package_manifests(self) -> None:
         payload: dict[str, object] = {