fix: stop importing existing GWS users into Pulumi state

The GWS provider validates email types during import, but GWS itself
returns empty types for primary/alias emails. This causes unrecoverable
validation errors on every new user import. Instead, skip managing
existing users entirely and let group memberships be created directly.

Also marks den as existingGWSUser.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/config/users.ts

@@ -358,6 +358,7 @@ export const MEMBERS: readonly Member[] = [
     firstName: 'Den',
     lastName: 'Delimarsky',
     googleEmailPrefix: 'den',
+    existingGWSUser: true,
     memberOf: [
       ROLE_IDS.AUTH_MAINTAINERS,
       ROLE_IDS.CORE_MAINTAINERS,

src/google.ts

@@ -81,49 +81,12 @@ MEMBERS.forEach((member) => {
   const primaryEmail = `${member.googleEmailPrefix}@modelcontextprotocol.io`;
 
   if (member.existingGWSUser) {
-    // Import existing user into Pulumi state without recreating
-    const user = new gworkspace.User(
-      `gws-user-${member.googleEmailPrefix}`,
-      {
-        primaryEmail,
-        name: { familyName: member.lastName!, givenName: member.firstName! },
-        orgUnitPath: mcpOrgUnit.orgUnitPath,
-      },
-      {
-        import: primaryEmail,
-        dependsOn: [mcpOrgUnit],
-        ignoreChanges: [
-          'recoveryEmail',
-          'recoveryPhone',
-          'password',
-          'hashFunction',
-          'changePasswordAtNextLogin',
-          'orgUnitPath',
-          'archived',
-          'suspended',
-          'isAdmin',
-          'includeInGlobalAddressList',
-          'ipAllowlist',
-          'addresses',
-          'aliases',
-          'customSchemas',
-          'emails',
-          'externalIds',
-          'ims',
-          'keywords',
-          'languages',
-          'locations',
-          'organizations',
-          'phones',
-          'posixAccounts',
-          'relations',
-          'sshPublicKeys',
-          'websites',
-          'name',
-        ],
-      }
-    );
-    provisionedUsersByEmail[primaryEmail] = user;
+    // Existing GWS users are not managed by Pulumi — the GWS provider's import
+    // validation rejects empty email types that GWS itself sets on primary/alias
+    // emails, and there's no way to fix this at the provider level.
+    // Group memberships for these users are created without dependsOn since the
+    // user already exists in GWS.
+    return;
   } else {
     // Create new user with random password
     const password = new random.RandomPassword(`gws-pwd-${member.googleEmailPrefix}`, {