KubeConflict wraps an error and turns it into a standard kube conflict response.

OptimisticWriteToSpiceDBAndKube ensures that a write exists in both SpiceDB and kube, or neither.

PessimisticWriteToSpiceDBAndKube ensures that a write exists in both SpiceDB and kube, or neither, using locks.

ResourceLockRel generates a relationship representing a worfklow's lock over a specific resource in kube.