feat(gcp): scoped Crossplane IAM identity for slice 5

[Smana]

First step of design slice 5 (GCPWorkloadIdentity): give Crossplane a GCP
identity, scoped rather than broad.

Single file. The rest of slice 5 — the Crossplane Flux tree here, and the XRD in
Smana/crossplane-configuration — follows separately; see What this does not
do.

What changed

opentofu/gcp/gke/init/iam.tf was a comment-only file. #1818 removed the
roles/editor grant it used to carry, because Crossplane was not deployed on
GCP and the binding had no consumer — it was a project-wide editor grant to
a ServiceAccount nothing created, reachable because namespaces/base creates
crossplane-system on GCP too.

Slice 5 gives it a consumer, so it comes back — as one binding:

roles/resourcemanager.projectIamAdmin
  member:    ns/crossplane-system/sa/provider-gcp
  condition: modifiedGrantsByRole.hasOnly(['roles/dns.admin'])

Why the condition is the substance

projectIamAdmin alone would be a large improvement on editor and still a
privilege-escalation path: setIamPolicy can grant any role to any principal,
including granting Crossplane itself roles/owner.

It is also the honest GCP analogue of the AWS side's xplane-* scoping. AWS
restricts Crossplane by resource name; GCP cannot for project IAM, because
the resource is the project — so it restricts by grantable role instead.
Worth stating plainly, because the earlier conclusion recorded in this repo was
that GCP had no equivalent. It does; it is on a different axis.

Adding a role to the allowlist is therefore deliberate. A workload needing
something outside it fails with a permission error naming the role, rather than
Crossplane quietly having had it all along.

Three things measured, not read

Each would have been a silent failure, and none is catchable by tofu validate.

1. GCP IAM conditions use a restricted CEL dialect. The first attempt allowed
predefined roles or xplane--prefixed custom ones via .all(...). The API
rejected it at apply:

Condition expression compilation failed:
undeclared reference to '@not_strictly_false'

hasOnly() is the supported form and matches exact strings only.

2. That forced a tighter design, which is the better one. Exact names mean a
dynamically-named custom role cannot be allowlisted, so roles/iam.roleAdmin
is not granted at all — GCPWorkloadIdentity's optional
customRole.permissions is deferred rather than half-enabled. Slice 5's actual
need (criterion 21: external-dns records, cert-manager DNS-01) is served
entirely by roles/dns.admin. The file records what re-enabling it would
require, and that widening the condition is not it.

3. The subject is the PROVIDER's ServiceAccount, not Crossplane's. The first
commit here named sa/crossplane. That could never have matched — Crossplane
core never talks to GCP; the provider pod makes the cloud API calls. AWS has
bound crossplane-system/provider-aws all along
(opentofu/aws/eks/init/iam.tf:56-57). Found by checking what AWS binds while
writing the provider manifests, not from any error — a wrong subject is
accepted by the API and simply never matches, surfacing later as permission
denials that point at the workload rather than the binding.

The corrected name must equal the serviceAccountTemplate in a
DeploymentRuntimeConfig that does not exist yet, and nothing checks that they
agree — so it is tied to its source in a comment.

Also settled while scoping (no code here, recorded for the next step)

• The API group question in the design was a false dichotomy. It expected
  cloudplatform.gcp.m.upbound.io while noting the docs say .upbound.io. The
  package ships both, all 32 CRDs in each flavour; the
  ManagedResourceActivationPolicy decides. .m.upbound.io is correct — it
  matches the AWS policy and Crossplane v2's namespaced MRs.
• provider-gcp-cloudplatform:v2.6.0 exists, matching every AWS provider.
• ClusterProviderConfig is gcp.m.upbound.io, credentials.source: InjectedIdentity, plus a GCP-only projectID field AWS has no equivalent for.

What this does not do

• No Crossplane on GCP yet: controller (reusable as-is — it is cloud-agnostic),
  provider, DeploymentRuntimeConfig naming provider-gcp, activation policy,
  ClusterProviderConfig.
• No GCPWorkloadIdentity XRD. It is authored in
  Smana/crossplane-configuration under apis/gcpworkloadidentity/ and needs a
  new crossplane-configuration-gcp package; only -aws:v0.1.0 exists
  today. The design warns that migrating a live cluster onto a package is a
  two-PR operation with prune: disabled first, or Flux prunes the XRDs and
  destroys every claim.

Verification

Applied against the live project, then torn down:

• gcloud projects get-iam-policy showed exactly one crossplane binding, with
  the condition attached and the member in the precise
  principal://.../ns/crossplane-system/sa/provider-gcp form design criterion
  19 requires.
• The stale sa/crossplane binding was destroyed, not left alongside.
• After teardown: 0 billable resources, and no IAM leftovers — the binding is
  OpenTofu-managed and went with the stack.
• tofu validate and tofu fmt clean.

[github-actions]

🔍 Rendered manifest diff — this PR vs main (desired state)

No changes to the rendered desired state. ✅