fix(cli): enrich contract materials before control-plane init

Move policy-group material enrichment back ahead of the control-plane Init
call so a policy-group load failure fails fast, before a workflow run is
created, avoiding orphaned/partially initialized attestations.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: db6acef0-3453-4c3f-ae8d-803dd2a677e7

Author: migmartri

app/cli/pkg/action/attestation_init.go

@@ -188,6 +188,28 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 		return "", ErrRunnerContextNotFound{err.Error()}
 	}
 
+	// Parse the raw contract to get V2 schema if available
+	var schemaV2 *v1.CraftingSchemaV2
+	if contractVersion.GetRawContract() != nil {
+		schemaV2 = parseContractV2(contractVersion.GetRawContract())
+	}
+
+	// Enrich the contract with the materials declared by its attached policy
+	// groups, so they show up during attestation. See issue #3222.
+	// Only the schema that the crafter will actually store needs enriching: it
+	// prefers the V2 schema when present and falls back to V1 otherwise.
+	// Done before the control-plane Init below so a policy-group load failure
+	// fails fast, before a workflow run is created.
+	if schemaV2 != nil {
+		err = enrichContractMaterialsV2(ctx, schemaV2, client, &action.Logger)
+	} else {
+		//nolint:staticcheck // TODO: Migrate to new contract version API
+		err = enrichContractMaterials(ctx, contractVersion.GetV1(), client, &action.Logger)
+	}
+	if err != nil {
+		return "", fmt.Errorf("failed to apply materials from policy groups: %w", err)
+	}
+
 	var (
 		// Identifier of this attestation instance
 		attestationID            string
@@ -268,26 +290,6 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 		}
 	}
 
-	// Parse the raw contract to get V2 schema if available
-	var schemaV2 *v1.CraftingSchemaV2
-	if contractVersion.GetRawContract() != nil {
-		schemaV2 = parseContractV2(contractVersion.GetRawContract())
-	}
-
-	// Enrich the contract with the materials declared by its attached policy
-	// groups, so they show up during attestation. See issue #3222.
-	// Only the schema that the crafter will actually store needs enriching: it
-	// prefers the V2 schema when present and falls back to V1 otherwise.
-	if schemaV2 != nil {
-		err = enrichContractMaterialsV2(ctx, schemaV2, client, &action.Logger)
-	} else {
-		//nolint:staticcheck // TODO: Migrate to new contract version API
-		err = enrichContractMaterials(ctx, contractVersion.GetV1(), client, &action.Logger)
-	}
-	if err != nil {
-		return "", fmt.Errorf("failed to apply materials from policy groups: %w", err)
-	}
-
 	// Initialize the local attestation crafter
 	// NOTE: important to run this initialization here since workflowMeta is populated
 	// with the workflowRunId that comes from the control plane