[9.5](backport #7794) refactor: clone ParsedPolicy in processPolicy to prevent shared-state races

[mergify]

Summary

• Adds ParsedPolicy.Clone() which returns a fully independent copy — every slice, map, and pointer field gets its own backing storage: SecretKeys and Policy.Namespaces via slices.Clone; Inputs, Roles (including RoleT.Raw bytes), and Outputs (including Output.Role pointers) deep-copied element by element; Agent and Fleet via maps.Clone; Policy.Data via model.ClonePolicyData.
• Also updates model.ClonePolicyData to clone its Agent and Fleet maps, OutputPermissions bytes, and OTel section maps via cloneOTelSection — necessary because prepareOTelExporters mutates per-component maps in-place; nil Inputs is preserved as nil.
• Moves the clone to the dispatch site in monitor.go: s.ch <- policy.pp.Clone() instead of &policy.pp. Each channel send now transfers an exclusively-owned *ParsedPolicy to its subscriber, so processPolicy receives a copy it already owns and can mutate freely — no implicit contract that callers must clone.
• processPolicy is unchanged in behaviour; the clone just moves upstream to the natural ownership-transfer boundary.
• Adds TestParsedPolicyCloneIsolation to verify that mutating each field of a clone does not affect the original.

References

Relates #7739

🤖 Generated with Claude Code

---

This is an automatic backport of pull request #7794 done by Mergify.

[mergify]

Cherry-pick of c907276 has failed:

On branch mergify/bp/9.5/pr-7794
Your branch is up to date with 'origin/9.5'.

You are currently cherry-picking commit c907276.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   internal/pkg/model/ext.go
	modified:   internal/pkg/policy/monitor.go
	modified:   internal/pkg/policy/parsed_policy.go
	modified:   internal/pkg/policy/parsed_policy_test.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   internal/pkg/api/handleCheckin.go
	both modified:   internal/pkg/api/handleCheckin_test.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[github-actions]

TL;DR

Buildkite failed because this backport branch still contains unresolved merge-conflict markers in internal/pkg/api/handleCheckin.go and internal/pkg/api/handleCheckin_test.go, which causes Go parsing to fail in every packaging lane.

Remediation

• Resolve the cherry-pick conflict blocks and remove <<<<<<<, =======, >>>>>>> markers in both files, keeping the 9.5-compatible processPolicy(...) / Prepare(...) call signatures consistently.
• Re-run CI (check-ci + package lanes) after conflict resolution to confirm parse/build success.

Investigation details

Root Cause

This is a code bug introduced by an incomplete conflict resolution during backporting. The PR diff itself shows conflict markers still present in processPolicy and its related test hunk:

• internal/pkg/api/handleCheckin.go around @@ -1067... (conflict between HEAD and commit c907276)
• internal/pkg/api/handleCheckin_test.go around @@ -1927... (same unresolved conflict pattern)

Because of those markers, the Go compiler/parser errors immediately before any functional tests can run.

Evidence

• Build: https://buildkite.com/elastic/fleet-server/builds/16767
• Failing jobs: Run check-ci, Package x86_64, Package x86_64 FIPS, Package aarch64, Package aarch64 FIPS
• Key log excerpts:
  • internal/pkg/api/handleCheckin.go:1082:1: expected statement, found '<<' (check-ci)
  • internal/pkg/api/handleCheckin_test.go:1930:1: expected statement, found '<<' (check-ci)
  • internal/pkg/api/handleCheckin.go:1082:1: syntax error: unexpected <<, expected } (all package lanes)

Verification

• Not run locally in this detective pass; analysis is based on Buildkite failure logs and PR diff content.

Follow-up

• After resolving markers, if any lane still fails, re-check for branch-specific signature mismatches in processPolicy(...) and policyOutput.Prepare(...) introduced by the backport merge.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.