fix: #3620408 Remove the edit canvas global regions permission from Site Admin

#3620408

Removes one line from recipe.yml: 'edit canvas global regions' from the site_admin grant.

Why

The permission is not upstream Drupal Canvas. vardot/varbase-patches carries feat: #3584713 Add Allow Edit Global Regions permission (canvas--2026-08-13--3584713--mr-911.patch), which adds it to canvas.permissions.yml plus the access check in canvas.module.

So it exists only where varbase-patches is applied. A plain Drupal CMS build does not require varbase-patches, so the permission is absent and Drupal strips the grant, logging:

Non-existent permission(s) assigned to role "Site Admin" (site_admin) were removed.
Invalid permission(s): edit canvas global regions

Observed in the site log after a fresh drupal/cms install with the Horizon Aid site template. It is the only permission in this recipe that behaves this way.

Trade-off

On a Varbase base the patch is applied and the grant works today, so site_admin loses it there too. That is intended: the #3584713 patch is being removed from vardot/varbase-patches in the same change, so the permission stops existing anywhere rather than existing on one base and not the other.

Testing

The stripped-permission warning was reproduced on a real build. This branch has not been installed — the change removes a grant that was already being discarded on Drupal CMS, so Testing to ensure no regression stays unticked pending a Varbase install that confirms nothing else expected the permission.

AI-Generated: Yes

Checkpoints

• File an issue
• Addition / Change / Update / Fix
• Automated unit testing coverage
• Automated functional testing coverage
• Testing to ensure no regression
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by a human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release