feat(framework): Enforce StartRun entitlement via can_execute

[chongshenng]

Gate ControlServicer.StartRun with the new typed can_execute call (ActionType.START_RUN, StartRunContext) and return NO_PERMISSIONS when denied. Update ControlServicer tests to verify denial behavior and the typed call contract.

Merge after:

• feat(framework): Add can_execute hook to FederationManager #6908

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d78827a0c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Copilot]

Pull request overview

This PR introduces an authorization gate for ControlServicer.StartRun by invoking the new typed FederationManager.can_execute hook and denying run creation when execution is not permitted.

Changes:

• Add can_execute enforcement to ControlServicer.StartRun using ActionType.START_RUN with a typed context.
• Return ApiErrorCode.NO_PERMISSIONS when can_execute denies the action.
• Extend ControlServicer tests to validate denial behavior and the can_execute call contract.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
framework/py/flwr/superlink/servicer/control/control_servicer.py	Adds the can_execute check for StartRun and constructs the typed authorization context.
framework/py/flwr/superlink/servicer/control/control_servicer_test.py	Adds tests for entitlement denial and for verifying can_execute is called with the expected typed arguments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[panh99]

LGTM!