Add Google Workspace-only account for Claude (#163)

Adds a 'service-accounts' role that carries no GitHub, Discord, or
Google group config and exists solely to make its members eligible
for GWS user provisioning, plus a member entry that provisions
claude@modelcontextprotocol.io. Claude has no GitHub or Discord
handle, so none of the existing provisionUser roles fit.

src/config/roleIds.ts

@@ -79,6 +79,11 @@ export const ROLE_IDS = {
   // ===================
   WG_IG_FACILITATORS: 'wg-ig-facilitators',
 
+  // ===================
+  // Service Accounts (GWS user only, no platform roles)
+  // ===================
+  SERVICE_ACCOUNTS: 'service-accounts',
+
   // ===================
   // Email Groups (Google only)
   // ===================

src/config/roles.ts

@@ -422,6 +422,16 @@ export const ROLES: readonly Role[] = [
     provisionUser: true,
   },
 
+  // ===================
+  // Service Accounts (GWS user only, no platform roles)
+  // ===================
+  {
+    id: ROLE_IDS.SERVICE_ACCOUNTS,
+    description: 'Service accounts with a Google Workspace user only (no GitHub or Discord)',
+    provisionUser: true,
+    // No github/discord/google config - exists solely to provision GWS user accounts
+  },
+
   // ===================
   // Email Groups (Google only)
   // ===================

src/config/users.ts

@@ -872,4 +872,11 @@ export const MEMBERS: readonly Member[] = [
     email: 'davideramian@anthropic.com',
     memberOf: [ROLE_IDS.ANTITRUST],
   },
+  {
+    email: 'claude@modelcontextprotocol.io',
+    firstName: 'Claude',
+    lastName: 'AI',
+    googleEmailPrefix: 'claude',
+    memberOf: [ROLE_IDS.SERVICE_ACCOUNTS],
+  },
 ] as const;