Cloud IAM permissions

The drift job that catches a console fix needs write access to the state lock

Terraform reads an emergency console change as a config mismatch and reverts it on the next scheduled apply. A dev.to writeup builds the CI job that catches it first, and explains why the plan-only role still needs lock writes.