Network and five buckets

With the APIs on, the CLI provisions the data plane and runtime identity:

• A custom-mode VPC with one explicitly named regional subnet and private Google access. The deployment's GKE cluster is pinned to both names.
• Five private Cloud Storage buckets, all uniform bucket-level access: -assets (marketing objects served through the same-origin /assets/* application route), -documents (client documents), -exports (Parquet/Iceberg archives), -logs (the Nearline log-sink destination), and -applications (each Project's published client-portal bundle, streamed same-origin through /app/projects/{code}/portal).
• A deployment-specific Google service account with the Secret Manager accessor role, object access on only that deployment's five buckets, Workload Identity bindings for the namespace's navigator-web and workflows-service Kubernetes service accounts, and permission to sign its own GCS URLs.
• A separate Workspace Drive service account with no runtime GCP roles. An operator creates one JSON key, records it in that deployment's secrets.enc.yaml, and grants its OAuth client domain-wide delegation in the selected Workspace.