fix: keep rebase_draft from operators who can only draft schedules and triggers

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

frontend/src/lib/components/copilot/chat/global/core.ts

@@ -4279,8 +4279,10 @@ export const globalTools: SessionTool<{}>[] = [
 			app: WRITE_DRAFT,
 			resource: WRITE_DRAFT,
 			variable: WRITE_DRAFT,
-			schedule: WRITE_SCHEDULE_DRAFT,
-			trigger: WRITE_TRIGGER_DRAFT
+			// Not the schedule/trigger draft rights: `rebaseDraft` has no handler for these kinds,
+			// so an operator holding only those rights would be offered a tool that always throws.
+			schedule: WRITE_DRAFT,
+			trigger: WRITE_DRAFT
 		} satisfies Record<(typeof ITEM_TYPES)[number], SessionToolPolicy>,
 		def: createToolDef(
 			rebaseDraftSchema,

frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts

@@ -76,10 +76,11 @@ const REACHABLE_PROFILES = [
 			[false, true].flatMap((operator) =>
 				// `checkDeployRules` bypasses on admin, so an admin has only the one outcome.
 				(isAdmin ? [true] : [false, true]).flatMap((deployRulesPass) =>
-					// The operator rights a workspace can set: none, the builder right, one lock, both.
+					// The operator rights a workspace can set: none, the builder right, either lock, both.
 					[
 						undefined,
 						{ builder_flows: true },
+						{ manage_schedules: false },
 						{ manage_triggers: false },
 						{ manage_schedules: false, manage_triggers: false }
 					].map((operatorSettings) => {