feat(grants): support Openflow account privileges (CREATE OPENFLOW ... INTEGRATION)

[GClunies]

What & Why

Snowflake Openflow (managed data ingestion, GA 2025) introduces account-level privileges that snowcap's GlobalPrivs enum doesn't know about, so granting a team the ability to run Openflow must be done with manual SQL:

GRANT CREATE OPENFLOW DATA PLANE INTEGRATION ON ACCOUNT TO ROLE data_engineer;
GRANT CREATE OPENFLOW RUNTIME INTEGRATION   ON ACCOUNT TO ROLE data_engineer;

grep -ri openflow snowcap/ returns nothing today.

Acceptance Criteria

• CREATE OPENFLOW DATA PLANE INTEGRATION and CREATE OPENFLOW RUNTIME INTEGRATION added to account-level privileges in snowcap/privs.py
• Grantable via YAML (priv: ... on_account: true) and applied correctly
• Fetch/plan round-trips these grants without spurious drift
• Docs (snowflake-permissions page) mention the new privileges

Resources

• Snowflake docs: Openflow
• Snowcap: snowcap/privs.py (no OPENFLOW entries)

[GClunies]

Closing as not planned. Deep dive into the Openflow docs showed the core lifecycle (deployments, runtimes, EAI attachment, connector config) is Openflow-UI/control-plane only — no CREATE DDL exists, so IaC coverage beyond the two account privileges is inherently limited. Not worth the maintenance surface right now.