fix(org,team): guard the owner team rename, show permission-only team access and tidy member lookups

Signed-off-by: bircni <bircni@icloud.com>

internal/app/teams_test.go

@@ -81,6 +81,24 @@ func TestTeamEditMergesUnitsIntoTheCurrentPolicy(t *testing.T) {
 	require.Len(t, sent, 2)
 }
 
+func TestTeamEditRefusesToRenameTheOwnerTeam(t *testing.T) {
+	var patched int
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPatch {
+			patched++
+		}
+		_, _ = w.Write([]byte(`{"id":3,"name":"Owners","permission":"owner","organization":{"username":"acme"}}`))
+	}))
+	defer server.Close()
+	deps, _, _ := serverDeps(t, server.URL)
+	err := Execute(context.Background(), deps, []string{"team", "edit", "3", "--name", "Admins"})
+	require.Equal(t, clierr.Usage, clierr.ExitCode(err), "%v", err)
+	require.ErrorContains(t, err, "owner team and cannot be renamed")
+	require.Zero(t, patched)
+	require.NoError(t, Execute(context.Background(), deps, []string{"team", "edit", "3", "--description", "Owners", "--json"}))
+	require.Equal(t, 1, patched)
+}
+
 func TestTeamRepoAddTakesRepositoriesAsArguments(t *testing.T) {
 	var granted []string
 	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {