gcp §3 Part B: collapse the oauth2 3-way token-acquisition fork (one CredentialFlow interface shape, N transport handlers) + fold the credentials.dag 'two handlers' wording nit; build off fixed main (#5275 Part A landed)

[gunbai-bot]

Summary

Completes gcp §3 Part B (builds on #5275 Part A): collapses the OAuth2 token-acquisition fork into one interface shape with N transport handlers per DESIGN.md §3.

• Add GcpOAuth2AccessTokenStrategy (AdcRefresh | GcloudCli) and OAuth2AccessToken variant to GcpCredentialFlow in extdeps/cloud/gcp/gcp.dag
• Document oauth2.Google.Refresh as the single REST interface; ADC file-read and gcloud CLI are peripheral handlers, not forked duplicates
• Add composition materializers in gunbc/auth/credentials.dag: gcp_oauth_access_token_via_adc_refresh (ReadADC → Refresh) and gcp_oauth_access_token_via_gcloud (AuthPrintAccessToken)
• Fold the §3 composition-vs-fork distinction into std/credentials.dag; remove the misleading "two realization handlers" wording from gunbc/auth/credentials.dag

Test plan

• cargo test -p v1-compiler-tests parse::gist_transitive_closure_parse — ok (includes gcp.dag, credentials.dag)
• cargo test -p v1-compiler-tests extdeps_shape_transport_policy_lens_test — 7/7 ok
• CI (gunbc ci) — passing on HEAD

[gunbai-bot]

Addressed the non-blocking observation on GcpOAuth2AccessTokenStrategy being declared but unconsumed.

Fix (1cdc57e): added gcp_oauth_access_token(strategy: GcpOAuth2AccessTokenStrategy) in gunbc/auth/credentials.dag — match-dispatches to the existing leaf materializers:

• AdcRefresh { adc_path: Present { value: path } } → gcp_oauth_access_token_via_adc_refresh(adc_path: path)
• AdcRefresh { adc_path: Absent } → gcp_oauth_access_token_via_adc_refresh() (default ADC path)
• GcloudCli → gcp_oauth_access_token_via_gcloud()

The _via_* patterns remain the leaf handlers; the strategy enum is now the dispatch tag for the unified entry point. Verified: parse::gist_transitive_closure_parse green.

— sent from gentle-koi-82

[gunbai-bot]

Addressed both non-blocking findings in 156931a:

Wildcard arm (gcp_oauth_access_token_adc_for_path) — Agree this is a substrate gap, not a permanent default. The third arm is now explicitly marked 🟡 SCAFFOLD — feature:literal-optional-none-match with dissolve-on: literal-built FilePath? = none encodes as Absent. Witness witness_adc_refresh_null_optional_path_holds stays until the substrate fix lands and the arm can be deleted.

Effect rows — Removed uses net: Network from the dispatch entry gcp_oauth_access_token so the GcloudCli arm no longer over-promises Network. Network remains declared only on the AdcRefresh leaf chain (gcp_oauth_access_token_adc_for_path / via_adc_refresh). Shell transport still has no declared resource in std.resources (same as gcp_secret_credential's auth step) — noted in comment on via_gcloud.

— sent from gentle-koi-82

[gunbai-bot]

Finding: missing Network import on perturbation pattern — Valid. gcp_oauth_access_token_dispatch_swapped had uses net: Network without import std.resources { Network }. Fixed by dropping the local uses clause: the perturbation calls the leaf handlers directly (via_adc_refresh declares Network; via_gcloud is shell-only), matching the dispatch entry pattern in credentials.dag. Both hermetic witnesses still green via gcp_oauth_access_token_materializer_holds.

— sent from gentle-koi-82