feat(config): record where the startup host grants came from

The startup log of the host grants names the source of the policy
(flag, environment or file) and never a path.

Assisted-by: Claude:claude-sonnet-5-5 go

core/cli/run.go

@@ -391,6 +391,7 @@ func (r *RunCMD) Run(ctx *cliContext.Context) (result error) {
 	}
 	opts := []config.AppOption{
 		config.WithAddonHostOps(hostOps.Grants),
+		config.WithAddonHostOpsSource(hostOps.Source),
 		config.WithAddonHostDeny(hostOps.Deny),
 		config.WithAddonHostBlanket(blanket),
 		config.WithAddonHostUIGrantsLocked(!r.AddonHostUIGrants),

core/config/addon_host_ops.go

@@ -122,6 +122,13 @@ func WithAddonHostDeny(deny map[string][]string) AppOption {
 	return func(o *ApplicationConfig) { o.AddonHostDeny = CloneAddonHostOps(snapshot) }
 }
 
+// WithAddonHostOpsSource records where the startup grants came from, for the
+// startup log. A path after a colon is dropped.
+func WithAddonHostOpsSource(source string) AppOption {
+	kind, _, _ := strings.Cut(source, ":")
+	return func(o *ApplicationConfig) { o.AddonHostOpsSource = kind }
+}
+
 // WithAddonHostBlanket sets the deployment blanket mode ("" leaves it to the UI).
 func WithAddonHostBlanket(mode string) AppOption {
 	return func(o *ApplicationConfig) { o.AddonHostBlanket = mode }

core/config/application_config.go

@@ -101,6 +101,9 @@ type ApplicationConfig struct {
 	// call. It is startup-only. Nil or empty means no add-on gets a host
 	// operation endpoint.
 	AddonHostOps map[string][]string `json:"-" yaml:"-"`
+	// AddonHostOpsSource names where the startup grants came from: flag,
+	// environment, policy or empty. It never holds a path.
+	AddonHostOpsSource string `json:"-" yaml:"-"`
 	// AddonHostDeny maps an add-on ID, or "*" for all, to host operation
 	// prefixes, exact names or "*" that no grant may enable. Startup-only;
 	// deny set in the UI is stored separately and applies live.