feat: provision GWS accounts for implicit maintainers (SDK teams, WGs)

GWS user accounts were only created for members whose direct roles had
google.provisionUser (lead/core maintainers, moderators, maintainers,
registry-wg). SDK maintainers and working-group members who opted in by
adding firstName/lastName/googleEmailPrefix (e.g. #148, #150, #152)
silently got no account.

- Move provisionUser from GoogleConfig to the Role level, and add it to
  the implicit-maintainer containers (sdk-maintainers, working-groups)
  plus the standalone maintainer roles (docs, inspector, mcpb,
  reference-servers, use-mcp, server-identity-wg, wg/ig facilitators).
- Eligibility now walks github.parent chains (hasProvisionUserRole),
  matching GitHub team-nesting semantics, so e.g. python-sdk members
  qualify via sdk-maintainers.
- validate-config now errors when a googleEmailPrefix would be a silent
  no-op (no eligible role and not an existing GWS user), so opt-in PRs
  like #150 fail CI instead of quietly doing nothing.

Newly provisioned on next apply: marcelo@, alexhancock@, liad@.
ochafik is now eligible but already has an account (existingGWSUser).

scripts/test-config.ts

@@ -8,6 +8,7 @@
 import { ROLES, buildRoleLookup, getRolesForPlatform } from '../src/config/roles';
 import { ROLE_IDS, isValidRoleId } from '../src/config/roleIds';
 import { MEMBERS } from '../src/config/users';
+import { hasProvisionUserRole } from '../src/config/utils';
 
 let passed = 0;
 let failed = 0;
@@ -84,7 +85,7 @@ test('TYPESCRIPT_SDK_AUTH role exists (GitHub-only)', () => {
 
 // Test Google Workspace user provisioning
 test('Roles with provisionUser exist', () => {
-  const provisionRoles = ROLES.filter((r) => r.google?.provisionUser);
+  const provisionRoles = ROLES.filter((r) => r.provisionUser);
   return provisionRoles.length > 0;
 });
 
@@ -100,9 +101,8 @@ test('googleEmailPrefix values are unique', () => {
 });
 
 test('skipGoogleUserProvisioning is only used in provisionUser roles and without fields', () => {
-  const provisionRoleIds = new Set(ROLES.filter((r) => r.google?.provisionUser).map((r) => r.id));
   return MEMBERS.every((member) => {
-    const inProvisionRole = member.memberOf.some((id) => provisionRoleIds.has(id));
+    const inProvisionRole = hasProvisionUserRole(member.memberOf, roleLookup);
     if (!inProvisionRole) return !member.skipGoogleUserProvisioning;
 
     const hasProvisioningFields = !!(
@@ -116,10 +116,7 @@ test('skipGoogleUserProvisioning is only used in provisionUser roles and without
 
 test('Some members in provisionUser roles have Google user fields', () => {
   const membersInProvisionRoles = MEMBERS.filter((m) =>
-    m.memberOf.some((id) => {
-      const role = roleLookup.get(id);
-      return role?.google?.provisionUser === true;
-    })
+    hasProvisionUserRole(m.memberOf, roleLookup)
   );
   const provisioned = membersInProvisionRoles.filter(
     (m) => m.firstName && m.lastName && m.googleEmailPrefix

scripts/validate-config.ts

@@ -8,7 +8,7 @@
 import { ROLES, buildRoleLookup } from '../src/config/roles';
 import { REPOSITORY_ACCESS } from '../src/config/repoAccess';
 import { MEMBERS } from '../src/config/users';
-import { resolveGoogleMemberEmail } from '../src/config/utils';
+import { hasProvisionUserRole, resolveGoogleMemberEmail } from '../src/config/utils';
 import type { RoleId } from '../src/config/roleIds';
 
 const roleLookup = buildRoleLookup();
@@ -131,10 +131,7 @@ console.log('Validating Google Workspace user provisioning fields...');
     }
 
     // Members in provisionUser roles without all three fields won't get a GWS account
-    const inProvisionUserRole = member.memberOf.some((roleId: RoleId) => {
-      const role = roleLookup.get(roleId);
-      return role?.google?.provisionUser === true;
-    });
+    const inProvisionUserRole = hasProvisionUserRole(member.memberOf, roleLookup);
 
     const hasProvisioningFields = !!(
       member.googleEmailPrefix &&
@@ -142,6 +139,20 @@ console.log('Validating Google Workspace user provisioning fields...');
       member.lastName
     );
 
+    // A googleEmailPrefix on a non-eligible member is a silent no-op in
+    // src/google.ts — no account gets created and nothing reports it.
+    // Fail loudly instead (members whose account already exists in GWS are
+    // exempt; those accounts are not managed by Pulumi).
+    if (member.googleEmailPrefix && !inProvisionUserRole && !member.existingGWSUser) {
+      console.error(
+        `ERROR: Member "${memberId}" has googleEmailPrefix but none of their roles ` +
+          `(or parent roles) has provisionUser, so no GWS account would be created. ` +
+          `Add provisionUser: true to an appropriate role in src/config/roles.ts or ` +
+          `remove the provisioning fields.`
+      );
+      hasErrors = true;
+    }
+
     if (member.skipGoogleUserProvisioning && !inProvisionUserRole) {
       console.error(
         `ERROR: Member "${memberId}" has skipGoogleUserProvisioning=true but is not in a provisionUser role`