feat(jsm): add Atlassian Assets (Insight/CMDB) tools for asset management - #5072

What

Adds nine JSM Assets (Atlassian Assets / Insight / CMDB) tools to the existing Jira Service Management integration, so workflows can read and write Atlassian Assets objects. This is the foundation for keeping JSM asset tables in sync (software/hardware asset management).

Tools

How

• Each tool proxies through an internal route (matching every other JSM tool) that resolves the Jira cloudId and the Assets workspaceId, then calls the Assets API via the OAuth 2.0 (3LO) gateway form: https://api.atlassian.com/ex/jira/{cloudId}/jsm/assets/workspace/{workspaceId}/v1/... — consistent with getJsmApiBaseUrl.
• workspaceId is discovered via GET /rest/servicedeskapi/assets/workspace (uses the already-granted read:servicedesk-request scope).
• All nine operations are wired into the jira_service_management block (dropdown, subBlocks with conditions/required, tools.access, tool() selector, params() mapping, outputs, inputs).

OAuth scopes added (jira provider)

read:cmdb-object:jira, write:cmdb-object:jira, delete:cmdb-object:jira, read:cmdb-schema:jira, read:cmdb-type:jira, read:cmdb-attribute:jira — each with a description in SCOPE_DESCRIPTIONS.

Validation

• tsc clean, biome clean, check:api-validation passes (route baseline bumped 828→837).
• Every endpoint, field name, response shape, and scope string verified against the live Atlassian Assets docs.

Notes

• Assets object attachments (file upload/download on objects) are a separate endpoint group and are intentionally out of scope here — none of these tools take file inputs.
• ⚠️ Smoke-test against a live Assets workspace before relying on AQL: the docs publish CMDB scopes for 3LO and POST /object/aql carries no OAuth exclusion (unlike the removed GET /aql/objects), but a real-token check is wise.

Pre-merge verification gates (do not skip)

Static validation is complete (tsc/biome/api-validation green; spec parity + internal semantics verified by multiple passes; 4 clean review rounds). The following require a live JSM+Assets instance and are not certifiable from code:

• Scope grant — confirm the Sim production Atlassian OAuth app has the Assets/CMDB scopes enabled in the Developer Console, then reconnect JSM and verify the issued token carries read:cmdb-object:jira (and write/delete for mutations). The 6 scope strings are verified correct and documented as OAuth 2.0 (3LO)-grantable, but enabling them on the registered app + user re-consent is an operational step.
• AQL smoke test — run jsm_search_objects_aql against a real workspace and confirm POST /object/aql returns results over 3LO (the deprecated GET /aql/objects was OAuth-blocked; the replacement is documented as accessible, but worth one live call).
• Base-URL — confirm one read call succeeds via the /ex/jira/{cloudId}/jsm/assets/... gateway host.
• Re-consent note — existing JSM connections must reconnect to pick up the new scopes.