Bootstrap the approval-gated GCP IAM workflow (supersedes #12565)

[gunbai-bot]

Supersedes #12565 (operator's Codex work, branch codex/gcp-iam-bootstrap, left untouched). Adopted into warm-badger-442's lane per operator decision 2026-10-04.

#12565 created iam-converge@, its WIF pool and its deny policy live; the receipts under docs/plans/receipts/gcp-iam-*-2026-09-2{8,9}/ are kept verbatim as evidence of the applied estate. This branch is #12565's head with main merged in.

Reconciliation with main

• extdeps.cloud.gcp.iam_admin: one import conflict (main added std.resources { Network }); resolved by keeping both GET, POST and Network.
• Every GCP operation Bootstrap the approval-gated GCP IAM workflow #12565 adds (iam_admin x6, iam x4, iam_deny x2, google.userinfo x1) now declares requires Network, as main's operations do.
• gunbc.auth.gcp_iam_bootstrap_model consumes gunbc.auth.gcp_iam_converge (roles, permissions, deny list, gcp_iam_converge_targets) and forks nothing. Main replaced mtcollins1_boot_dedicated_federation with provisioned_boot_federations/boot_dedicated_federation; the mtcollins1 pool, provider, service account and environment names are identical to those the receipts applied, and mtcollins1 is still the only provisioned host — no model/live drift found at the name level.

No live IAM mutation here; the iam_bootstrap_apply run is a separate operator-approved dispatch.

🤖 Generated with Claude Code

[gunbai-bot]

Addressing review 75821 (automated, at f407722; it hit max-runtime-exceeded, but I'm treating the findings as real):

1. Regex closure helper (tools/tests/dag_validation_closure.py): fixed in 610120d. Deleted. The plan doc's Validation section now points to the required floor lane instead of a manual recipe.
2. Witness reached only by the manual recipe: incorrect. The required floor job at f407722 (job 111481981249) planned and passed all 18 test.claim.auth.gcp_iam_bootstrap_witness_test claims ([changed-witness] ... standing=planned-and-passed; the job's summary reads planned=690 executed=690 claims_failed=0). It is discovered from test/claim/ like every other witness, so the merge path re-runs it.
3. Receipts under docs/plans/receipts/: keeping them, deliberately. They aren't transcribed measurements of something the tree can re-derive. They record an out-of-band, operator-approved live IAM actuation from 2026-09-28/29 (iam-converge@, its WIF pool, the deny policy). Nothing on the merge path can re-produce that output without mutating live IAM again, which this work item forbids. The operator's adoption brief requires keeping them as the evidence the model is reconciled against. The instrument that re-derives the state (not the logs) is gunbc.auth.gcp_iam_bootstrap itself: its next iam_bootstrap_apply run reads back every existing cell and refuses adoption on drift.