fix(gateway): Profile 포괄 운영 권한 제거

app/gateway-api/test/adminOperations.test.ts

@@ -357,7 +357,7 @@ describe('admin profile navigation API', () => {
             async () => {
                 throw new Error('not used');
             },
-            { adminRoles: ['admin.profiles.manage:che:2'], firstUserIsAdmin: false }
+            { adminRoles: ['admin.profiles.settings:che:2'], firstUserIsAdmin: false }
         );
 
         await expect(harness.caller.admin.profiles.listNavigation()).resolves.toEqual([
@@ -737,9 +737,11 @@ describe('admin operation API', () => {
             { adminRoles: ['admin.scenarios.reset:che:2'], firstUserIsAdmin: false }
         );
 
-        await expect(harness.caller.admin.capabilities.list()).resolves.toContainEqual(
+        const capabilities = await harness.caller.admin.capabilities.list();
+        expect(capabilities).toContainEqual(
             expect.objectContaining({ permission: 'admin.scenarios.reset', scopes: ['che:2'] })
         );
+        expect(capabilities).not.toContainEqual(expect.objectContaining({ permission: 'admin.profiles.manage' }));
     });
 });
 
@@ -902,7 +904,7 @@ describe('gateway release API', () => {
             async () => {
                 throw new Error('not used');
             },
-            { adminRoles: ['admin.profiles.manage:che:2'], firstUserIsAdmin: false }
+            { adminRoles: ['admin.profiles.runtime:che:2'], firstUserIsAdmin: false }
         );
 
         await expect(harness.caller.admin.releases.gatewayState()).rejects.toMatchObject({ code: 'FORBIDDEN' });
@@ -1459,6 +1461,25 @@ describe('Gateway administrator account controls', () => {
         expect((await harness.users.findById(target.id))?.roles).toEqual(['user']);
     });
 
+    it('rejects the removed umbrella profile capability', async () => {
+        const harness = await buildCaller(unusedCreateOperation);
+        const target = await harness.users.createUser({
+            username: 'removed-profile-capability-target',
+            password: 'secretpass',
+            displayName: 'Removed Profile Capability Target',
+        });
+
+        await expect(
+            harness.caller.admin.users.updateRoles({
+                userId: target.id,
+                roles: ['admin.profiles.manage:che:default'],
+                mode: 'grant',
+                reason: '제거한 포괄 권한 거부 확인',
+            })
+        ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        expect((await harness.users.findById(target.id))?.roles).toEqual(['user']);
+    });
+
     it('extends an unverified local account grace period and flushes active sessions', async () => {
         const harness = await buildCaller(unusedCreateOperation);
         const target = await harness.users.createUser({

app/gateway-api/test/releaseManifest.test.ts

@@ -38,8 +38,8 @@ describe('readReleaseManifest', () => {
 
         await expect(readReleaseManifest(workspaceRoot)).resolves.toMatchObject({
             controllerProtocol: RELEASE_CONTROLLER_PROTOCOL,
-            gatewaySchemaHead: '20260813000000_split_gateway_profile_identity',
-            gameSchemaHead: '20260816000000_add_read_model_change_journal',
+            gatewaySchemaHead: '20260817000000_remove_profile_manage_capability',
+            gameSchemaHead: '20260817000000_add_general_access_batch',
         });
     });