`pulumi policy new` and `pulumi install` fail for `runtime: opa` policy packs

pulumi policy new exits 1 for every OPA template in pulumi/templates-policy (aws-opa, azure-opa, gcp-opa, kubernetes-opa, all runtime: opa). After writing PulumiPolicy.yaml and policy.rego, it tries to load a pulumi-language-opa language plugin to install dependencies. That plugin does not exist: pulumi/pulumi-policy-opa ships only the policy-opa analyzer. pulumi install inside an OPA pack fails the same way. --generate-only exits 0, but its next steps tell you to run pulumi install, which fails. Running the pack works (pulumi preview --policy-pack <dir>), because the analyzer load path falls back to pulumi-analyzer-policy-<runtime> and auto-installs it since #22194.

Repro

mkdir opa-pack && cd opa-pack
pulumi policy new aws-opa --non-interactive
echo $?    # 1
pulumi install
echo $?    # 1

Expected

pulumi policy new aws-opa --non-interactive exits 0 with the pack ready to use, and pulumi install in the pack succeeds.

Actual

error: failed to load language plugin opa: no language plugin 'pulumi-language-opa' found in the workspace or on your $PATH

The pack files are written before the error, so the directory is left with a pack but a failed command.

How it should work

The install step should handle a runtime with no language plugin the same way the run path does. It should skip language dependency installation and make sure the policy-<runtime> analyzer plugin is installed, reusing the auto-install mechanism added for #22194 (loadPolicyAnalyzer, which installs the missing spec via pkgWorkspace.InstallPlugin and honours PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION). This applies in InstallPluginDependencies, used by pulumi policy new and pulumi install, and in installRequiredPolicy, used when installing packs enforced by the Pulumi Cloud backend. With that, pulumi policy new should exit 0 for OPA templates.

Found by reading the code, not reproduced: installRequiredPolicy also calls Host.LanguageRuntime for the pack runtime with no fallback, so the first pulumi preview or pulumi up on a stack that enforces a published runtime: opa pack should fail with the same error. pulumi policy publish does not appear to go through this path.

Where

• policy new installs dependencies unless --generate-only: https://github.com/pulumi/pulumi/blob/0ad612e0a5aebdf51612a28fba7a2025d607ce84/pkg/cmd/pulumi/policy/policy_new.go#L221-L226
• InstallPluginDependencies requires a language plugin: https://github.com/pulumi/pulumi/blob/0ad612e0a5aebdf51612a28fba7a2025d607ce84/pkg/cmd/pulumi/policy/io.go#L96-L99
• pulumi install in a policy pack reaches the same function: https://github.com/pulumi/pulumi/blob/0ad612e0a5aebdf51612a28fba7a2025d607ce84/pkg/cmd/pulumi/install/install.go#L82
• Enforced pack install requires a language plugin: https://github.com/pulumi/pulumi/blob/0ad612e0a5aebdf51612a28fba7a2025d607ce84/pkg/backend/httpstate/policypack.go#L561-L564
• Run path falls back to pulumi-analyzer-policy-<runtime> when no language plugin exists: https://github.com/pulumi/pulumi/blob/0ad612e0a5aebdf51612a28fba7a2025d607ce84/pkg/resource/plugin/analyzer_plugin.go#L150-L201
• Analyzer auto-install from #22194: https://github.com/pulumi/pulumi/blob/0ad612e0a5aebdf51612a28fba7a2025d607ce84/pkg/engine/update.go#L775-L818