Promote the 2026-08-30 review security fixes and supplies ordering to main

plugins/warranty/plugin.py

@@ -174,5 +174,13 @@ class WarrantyPlugin(BasePlugin):
             ('warranty.delete', 'Delete warranties', 'warranty'),
         ]
 
+    def get_guest_grantable_permissions(self) -> List[str]:
+        """Coverage dates and vendor for an asset somebody is standing at.
+
+        Nothing here is a credential and nothing reaches a supplier portal; the
+        provider lookups run server-side with keys the caller never sees.
+        """
+        return ['warranty.view']
+
     def init_app(self, app: Flask, db_instance) -> None:
         logger.info(f"Warranty plugin initialized (v{self.meta.version})")