[isthmia] Renaming a DirectusPermissionRule deletes the permission the new rule adopted

## Observed symptom Renaming a DirectusPermissionRule deletes the permission the new rule adopted `ensurePermission` (`packages/infrastructure/src/directus/client.ts:268`) adopts an existing permission row that matches (policy, collection, action) and returns its id. When a rule's Pulumi resource name changes but its key stays the same, Pulumi creates the new resource, which adopts the row, then deletes the old resource, which holds the same `permissionId`. The row is gone, and nothing reports it. Seen when `crm-staff-classes-update` was renamed to `crm-staff-classes-update-program_id` (`packages/infrastructure/src/crm/index.ts:110-116`). A forced `--replace` recreated it later. ## Environment GitHub cyc-seattle/isthmia #168 ## Trigger / context Public GitHub report in cyc-seattle/isthmia (FRESH_7D). ## Source evidence - https://github.com/cyc-seattle/isthmia/issues/168 (2026-09-26T04:42:02Z) — evidence_class: PRIMARY_ISSUE_REPORT — #168 ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T10:50:53.329738Z - scout_id: C19ed4f39a2 ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome. Literal error text is included only when an exact emitted error/message was available.