A profile in `profile-drafts/` silently resolves none of its `extends` chain

[nichenke]

What happened?

The same profile JSON resolves its base differently depending only on which directory it is in.
nono profile show on a file in ~/.config/nono/profile-drafts/ reports none of the grants its
extends target contributes; the identical file in ~/.config/nono/profiles/ reports all of them.

Nothing indicates a problem: nono profile validate reports the draft valid, and nono profile show
renders no warning about an unresolved base.

Concretely, with a profile whose extends is a user profile contributing four filesystem entries:

$ nono profile show ~/.config/nono/profile-drafts/claude-harness-config.json | grep -cE 'gh-nono|nono-ssh|agent\.sock'
0
$ cp ~/.config/nono/profile-drafts/claude-harness-config.json ~/.config/nono/profiles/x.json
$ nono profile show ~/.config/nono/profiles/x.json | grep -cE 'gh-nono|nono-ssh|agent\.sock'
4

Same bytes, same command form, different directory. Resolving by name once the file is in
profiles/ gives 4 as well, so it is the location and not the reference form.

What did you expect to happen?

Either the draft resolves its extends chain like any other profile, or show/validate says it
cannot.

Why it matters

profile-drafts/ exists to hold a profile for review before nono profile promote moves it into
profiles/. Both things that directory is for are undermined:

• A draft cannot be reviewed for what it will permit — it renders far narrower than what will
  actually run, so a reviewer approves a different profile from the one that ships.
• A draft cannot be behaviourally tested in place either. In our case the unresolved entries
  included the ssh config directory and an agent socket, so a gate run against the draft failed
  operations that promotion alone would have fixed.

The practical workaround is to promote first and test after, which is the reverse of what the
review-then-promote workflow implies.

nono version

0.71.0 (also present in main at f6a1519)

Operating system

macOS (Apple silicon)

[nogent-nolabs-ai]

🛡️ nogent issue triage

Assessment: needs-code-change

Suggested resolution: Modify the profile resolution and validation code in crates/nono-cli to properly resolve base profiles for draft directories or fail-closed with an explicit error when inheritance cannot be resolved.

Notes for maintainers: The silent failure of the extends chain resolution violates the fail-closed principle. Ensure that any unresolved parent profile in the CLI's profile loading or validation modules returns a fatal validation error instead of silently succeeding.

_{Automated triage suggestion. Not a maintainer decision.}