CI-001C1: add protected staging-only keyless authority proof

[daliu]

Outcome

Adds one protected, staging-only GitHub OIDC proof with no downloaded key and no Firebase deployment permission. The new manual workflow can authenticate only from the exact Run-MPRC repository, immutable organization/repository IDs, main, the staging environment, and this one verifier workflow; after named approval it reads only the exact active staging project identity.

Closes #667. Parent #133 remains open for reviewed Firebase deployment roles and production protection.

Invariants and failure cases

• Exact immutable owner/repository IDs, refs/heads/main, staging, and the verifier workflow are checked before authentication.
• The dedicated service account has zero user-managed keys and one custom permission: resourcemanager.projects.get.
• GitHub environment policy names two existing individual organization administrators, daliu and jeffchang5, and admits only main.
• Missing/wrong context or either missing locator produces one fixed diagnostic before OIDC.
• The post-auth script performs one fixed project GET; it emits no token, provider locator, response body, Firebase data, or arbitrary provider error.
• No workflow step deploys, enables an API, creates/updates/deletes a resource, inspects Firestore data, reaches an outside provider, or acts in production.

Provider configuration read back

• Staging only: IAM, STS, and Service Account Credentials APIs enabled.
• One active dedicated workload identity pool/provider with the exact admission condition.
• One dedicated keyless service account.
• One custom project role containing only resourcemanager.projects.get.
• One service-account impersonation binding for the admitted numeric repository principal set.
• GitHub staging environment: exact main, two named individual reviewers, one exact project variable, and only the two locator-secret names.
• No billing, Auth, Firestore, Rules, indexes, Functions, App Check, Storage data, provider sandbox, Hosting release, production IAM, DNS, Pages, Netlify, or production-data change.

Verification

• npm run test:staging-authority — 6/6 passed.
• Complete workflow/source safety suite — 108/108 passed.
• Frontend Jest — 18 suites, 1,346/1,346 passed.
• Frontend lint ledger — 120 files, exact 113 errors/6 warnings baseline verified.
• Functions lint — passed.
• Functions Jest under Node 20.19.5 — 69 suites, 7,569/7,569 passed; 2 suites/64 tests intentionally skipped by the existing baseline.
• Firestore Rules under Node 20.19.5 and Java 21.0.12 against demo-rules-test — 5 suites, 418/418 passed.
• Synthetic staging optimized build and executable artifact check — passed.
• YAML parse, Bash syntax, git diff --check, and zero source mutation-command checks — passed.

Officer continuity

Officer impact: Dave Liu or Jeff Chang can approve a staging identity check without handling a cloud key. This does not provide a backend or website publish button.

Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/ACCESS_CONTINUITY.md, and docs/officers/PUBLISH_AND_CHECK.md, plus matching engineering design/runbook records.

Deployment evidence: Google Cloud staging IAM/WIF and GitHub staging environment were configured and read back separately. Source is committed and tested but is not merged yet. Website not published; Firebase Hosting unchanged; Firebase backend not deployed; outside providers not configured; production behavior not tested.

Undo

Use one reviewed security change to remove the two staging locator secrets and disable the federation provider or its service-account binding. Do not delete the Firebase project or unrelated IAM bindings. Revert or safely roll forward the workflow source through a separate reviewed pull request.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	4867ace
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a8f41440bb8610008172d39
😎 Deploy Preview	https://deploy-preview-668--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Independent second-pass review complete: no findings. Verified manual-only trigger; workflow-level empty permissions; protected staging environment; exact contents:read and id-token:write job permissions; SHA-pinned actions; five-minute token; context validation before OIDC; one fixed read-only Cloud Resource Manager GET; fixed redacted output; no deploy/mutation command; no long-lived credential; exact one-permission IAM role; zero user-managed service-account keys; exact numeric repository admission; exact main/staging/workflow condition; and current officer/undo documentation. I will merge only after all required hosted checks pass. Website, Firebase backend, outside providers, billing, and production remain unchanged.