Add Google analytics provisioning

[intel352]

Summary

• Extends workflow-plugin-analytics with YAML-first Google provisioning via analytics.google_provider, step.analytics_google_ga4_ensure, and step.analytics_google_gtm_ensure.
• Adds GA4 property/web-stream and GTM container/workspace/gtag reconcilers with dry-run, audit JSONL, and explicit ADC opt-in.
• Documents gocodealone-multisite deploy.yaml / pipelines.apply wiring up to the Google API-access blocker.

Design

See: docs/plans/2026-05-26-google-analytics-provisioning-design.md

Implementation Plan

See: docs/plans/2026-05-26-google-analytics-provisioning.md

Scope Manifest

• PR Count: 1
• Tasks: 6
• Status: Locked
• PR row: 1 | Add Google analytics provisioning | Task 1, Task 2, Task 3, Task 4, Task 5, Task 6 | feat/google-analytics-provisioning

Verification

• GOWORK=off go test ./... — pass
• GOWORK=off go build ./... — pass
• scope lock: plan-scope-check.sh --verify-lock ... — pass
• GA4 dry-run CLI smoke — pass, returns planned create_property + create_web_data_stream
• GTM dry-run CLI smoke — pass, returns planned create_container + create_workspace + create_gtag_config
• live GA4 without credentials — blocked before mutation with google credentials are required for live GA4 ensure

Runtime launch transcript

Build:

$ GOWORK=off go build ./...
# exit 0

Launch / representative plugin CLI calls:

$ GOWORK=off go run ./cmd/workflow-plugin-analytics --wfctl-cli analytics google ga4 ensure --account accounts/123 --property-name example.com --stream-name example.com --default-uri https://example.com --dry-run
{
  "account": "accounts/123",
  "dry_run": true,
  "operations": [
    {"name": "create_property", "status": "planned"},
    {"name": "create_web_data_stream", "status": "planned"}
  ]
}

$ GOWORK=off go run ./cmd/workflow-plugin-analytics --wfctl-cli analytics google gtm ensure --account accounts/456 --container-name example.com --domain example.com --measurement-id G-ABC123 --dry-run
{
  "account": "accounts/456",
  "dry_run": true,
  "operations": [
    {"name": "create_container", "status": "planned"},
    {"name": "create_workspace", "status": "planned"},
    {"name": "create_gtag_config", "status": "planned"}
  ]
}

Failure-signature scrape: clean for dry-run launch; no panics, missing modules, stack traces, or permission/resource errors.

Deploy blocker

Live provisioning for gocodealone-multisite intentionally stops until the operator provides Google API access, account IDs, and credential secret wiring. CLI and YAML examples remain dry_run: true until then.

Review note

Per May 2026 workspace guidance, Copilot review is not required while it is broken; green CI is the PR gate.