Expand description
Cedar action names (P2, nghr 645809c3).
Keep in sync with policies/trustee_schema.cedarschema — the schema and
the embedded policy ship atomically with these constants; a filesystem
policy override referencing removed actions will deny everything (loud,
by design).