GWS user accounts were only created for members whose direct roles had
google.provisionUser (lead/core maintainers, moderators, maintainers,
registry-wg). SDK maintainers and working-group members who opted in by
adding firstName/lastName/googleEmailPrefix (e.g. #148, #150, #152)
silently got no account.
- Move provisionUser from GoogleConfig to the Role level, and add it to
the implicit-maintainer containers (sdk-maintainers, working-groups)
plus the standalone maintainer roles (docs, inspector, mcpb,
reference-servers, use-mcp, server-identity-wg, wg/ig facilitators).
- Eligibility now walks github.parent chains (hasProvisionUserRole),
matching GitHub team-nesting semantics, so e.g. python-sdk members
qualify via sdk-maintainers.
- validate-config now errors when a googleEmailPrefix would be a silent
no-op (no eligible role and not an existing GWS user), so opt-in PRs
like #150 fail CI instead of quietly doing nothing.
Newly provisioned on next apply: marcelo@, alexhancock@, liad@.
ochafik is now eligible but already has an account (existingGWSUser).
8eb21f43ff