gcp-keylesslisted

# GCP Keyless Remove human Google OAuth from the steady-state agent path. Prefer short-lived, auditable identity: attached metadata identity inside GCP, or a typed GitHub Actions workflow authenticated through Workload Identity Federation (WIF). ## Start with diagnosis Run: ```bash python3 scripts/doctor.py --repo OWNER/REPO --workflow gcp-keyless-observe.yml ``` Read its JSON and follow exactly one route: - `managed-metadata`: run directly with the attached service account. Verify the reported email is the intended identity before accessing the project. - `github-dispatch`: dispatch a reviewed, typed workflow. Local Google credentials are neither needed nor consulted. - `human-oauth-fallback`: credentials currently work, but they are not the durable solution. Use them only for the one-time WIF bootstrap or an explicitly approved emergency. - `bootstrap-required`: stop and follow [references/bootstrap.md](references/bootstrap.md). ## Non-negotiable controls 1. Never create, download, accept, or recommend a service-account JSON key. 2. Never print access tokens, OIDC tokens, authorization headers, or credential JSON. The official auth action may create an ephemeral WIF external-account file on its short-lived runner for `gcloud`; it is not a private key and must never be archived. 3. Never treat a working GitHub login as proof of GCP authority. It only authorizes dispatch; the WIF provider and service-account binding authorize GCP. 4. Never expose arbi