docs: scope GCP root agent guidance

[xnoto]

Summary

• retain WIF/bootstrap-state boundaries
• align guidance with GitHub-MCP and CI-plan workflow

Validation

• Pending PR CI.

[github-actions]

OpenTofu CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # google_iam_workload_identity_pool.kubernetes will be created
  + resource "google_iam_workload_identity_pool" "kubernetes" {
      + deletion_policy           = "DELETE"
      + description               = "k3s ServiceAccount identities for Make IT Work Cloud workloads."
      + display_name              = "k3s workloads"
      + id                        = (known after apply)
      + mode                      = (known after apply)
      + name                      = (known after apply)
      + project                   = "makeitworkcloud"
      + state                     = (known after apply)
      + workload_identity_pool_id = "kubernetes"
    }

  # google_iam_workload_identity_pool_provider.opencode_kubernetes will be created
  + resource "google_iam_workload_identity_pool_provider" "opencode_kubernetes" {
      + attribute_condition                = "assertion.sub == \"system:serviceaccount:opencode:opencode-mcp\""
      + attribute_mapping                  = {
          + "google.subject" = "assertion.sub"
        }
      + deletion_policy                    = "DELETE"
      + display_name                       = "OpenCode k3s workload"
      + id                                 = (known after apply)
      + name                               = (known after apply)
      + project                            = "makeitworkcloud"
      + state                              = (known after apply)
      + workload_identity_pool_id          = "kubernetes"
      + workload_identity_pool_provider_id = "opencode"

      + oidc {
          + issuer_uri = "https://api.makeitwork.cloud"
        }
    }

  # google_project_iam_member.opencode_mcp["roles/browser"] will be created
  + resource "google_project_iam_member" "opencode_mcp" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:opencode-mcp@makeitworkcloud.iam.gserviceaccount.com"
      + project = "makeitworkcloud"
      + role    = "roles/browser"
    }

  # google_project_iam_member.opencode_mcp["roles/cloudkms.viewer"] will be created
  + resource "google_project_iam_member" "opencode_mcp" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:opencode-mcp@makeitworkcloud.iam.gserviceaccount.com"
      + project = "makeitworkcloud"
      + role    = "roles/cloudkms.viewer"
    }

  # google_project_iam_member.opencode_mcp["roles/iam.securityReviewer"] will be created
  + resource "google_project_iam_member" "opencode_mcp" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:opencode-mcp@makeitworkcloud.iam.gserviceaccount.com"
      + project = "makeitworkcloud"
      + role    = "roles/iam.securityReviewer"
    }

  # google_project_iam_member.opencode_mcp["roles/mcp.toolUser"] will be created
  + resource "google_project_iam_member" "opencode_mcp" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:opencode-mcp@makeitworkcloud.iam.gserviceaccount.com"
      + project = "makeitworkcloud"
      + role    = "roles/mcp.toolUser"
    }

  # google_project_iam_member.opencode_mcp["roles/serviceusage.serviceUsageViewer"] will be created
  + resource "google_project_iam_member" "opencode_mcp" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:opencode-mcp@makeitworkcloud.iam.gserviceaccount.com"
      + project = "makeitworkcloud"
      + role    = "roles/serviceusage.serviceUsageViewer"
    }

  # google_project_service.this["cloudcli.googleapis.com"] will be created
  + resource "google_project_service" "this" {
      + deletion_policy    = "DELETE"
      + disable_on_destroy = false
      + id                 = (known after apply)
      + project            = "makeitworkcloud"
      + service            = "cloudcli.googleapis.com"
    }

  # google_service_account.opencode_mcp will be created
  + resource "google_service_account" "opencode_mcp" {
      + account_id      = "opencode-mcp"
      + deletion_policy = "DELETE"
      + disabled        = false
      + display_name    = "OpenCode managed MCP"
      + email           = "opencode-mcp@makeitworkcloud.iam.gserviceaccount.com"
      + id              = (known after apply)
      + member          = "serviceAccount:opencode-mcp@makeitworkcloud.iam.gserviceaccount.com"
      + name            = (known after apply)
      + project         = "makeitworkcloud"
      + unique_id       = (known after apply)
    }

  # google_service_account_iam_member.opencode_mcp_workload_identity_user will be created
  + resource "google_service_account_iam_member" "opencode_mcp_workload_identity_user" {
      + etag               = (known after apply)
      + id                 = (known after apply)
      + member             = (known after apply)
      + role               = "roles/iam.workloadIdentityUser"
      + service_account_id = (known after apply)
    }

Plan: 10 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + opencode_mcp_service_account_email      = "opencode-mcp@makeitworkcloud.iam.gserviceaccount.com"
  + opencode_mcp_workload_identity_provider = (known after apply)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.