[tim-thacker-nullify]

Cloud setup guidance disagrees with collector contracts, and GCP grants log-entry access it does not use.

• Correct GCP/Azure setup, GKE identity examples and exact upload-prefix guidance.
• Replace GCP Logs Viewer in Terraform and gcloud; align discovery/IAM grants and uninstall cleanup.
• Correct signing-key trust claims and Terraform save/validate instructions.
• Stage approved Artifact Hub ownership metadata and collector chart 0.6.1 without changing 0.6.0.
• Verify public versions, package digests, chart identities and ownership metadata after deployment.
• Execute gcloud create/update/uninstall permission parity checks in CI; ignore Python caches.

flowchart LR
  TOKEN["Signed tenant token"] --> STS["Google STS<br/>tenant claim check"]
  STS --> SA["Customer service account"]
  SA --> CHANGE["This PR: custom logging metadata permissions"]
  CHANGE --> CONFIG["Sink, metric and bucket configuration"]

Loading

Evidence: three credential-free GCP plans pass on Terraform 1.8.5 and 1.14.8; eight HTTP consumer tests and credential-free gcloud install/uninstall checks pass. A strict Helm dry run preserved four public versions and prepared 0.6.1; chart/RBAC/upload-scope checks pass.

Correctness confidence: moderate-high; collector calls match the narrowed permissions, but live GCP/customer acceptance remains unverified.
Merge risk: medium across IAM and publication workflow changes. Deployment risk is higher: applying Terraform removes an existing grant; customer IAM changes and the prepared release remain unapplied.