fix: preserve deadline in singleflight context to bound RPC lifetime

context.WithoutCancel detaches cancellation but also drops the deadline.
Re-apply the original deadline so gRPC calls inside singleflight still
have a bounded lifetime under server outage conditions.

Addresses cubic-dev-ai review feedback.

Signed-off-by: Vibhav Bobade <vibhav.bobde@gmail.com>

Author: waveywaves

pkg/policies/group_loader.go

@@ -137,7 +137,14 @@ func (c *ChainloopGroupLoader) Load(ctx context.Context, attachment *v1.PolicyGr
 		}
 
 		providerRef := ProviderParts(ref)
+		// Detach from caller's cancellation (so one goroutine's cancel doesn't
+		// kill the shared singleflight call) but preserve a bounded deadline.
 		sfCtx := context.WithoutCancel(ctx)
+		if deadline, ok := ctx.Deadline(); ok {
+			var cancel context.CancelFunc
+			sfCtx, cancel = context.WithDeadline(sfCtx, deadline)
+			defer cancel()
+		}
 
 		resp, err := c.Client.GetPolicyGroup(sfCtx, &pb.AttestationServiceGetPolicyGroupRequest{
 			Provider:  providerRef.Provider,

pkg/policies/loader.go

@@ -197,7 +197,14 @@ func (c *ChainloopLoader) Load(ctx context.Context, attachment *v1.PolicyAttachm
 		}
 
 		providerRef := ProviderParts(ref)
+		// Detach from caller's cancellation (so one goroutine's cancel doesn't
+		// kill the shared singleflight call) but preserve a bounded deadline.
 		sfCtx := context.WithoutCancel(ctx)
+		if deadline, ok := ctx.Deadline(); ok {
+			var cancel context.CancelFunc
+			sfCtx, cancel = context.WithDeadline(sfCtx, deadline)
+			defer cancel()
+		}
 
 		resp, err := c.Client.GetPolicy(sfCtx, &pb.AttestationServiceGetPolicyRequest{
 			Provider:   providerRef.Provider,