Dev credential stubs and provider switches

## Requirement Original requirement (epic, verbatim): "Add support for GCP and Azure with the same functionality as AWS: - Your Cloud (former Your AWS) - NodeLink may work on GCP and Azure - What else we have AWS specific Out of Scope: Jaah Hosted (still remains AWS only)" Acceptance this child owns (PRD, verbatim): - R10 "Create stubs for creds and tell me to fill in." - AC10.1 Once the GCP and Azure credential types exist on the dev CP, a build stage creates placeholder credential rows **`jaah/test/gcp`** (type GCP) and **`jaah/test/azure`** (type Azure) on the dev CP, through the console UI, with a description stating "PLACEHOLDER — paste a service-account key for project <…> / service-principal for subscription <…>" and the exact IAM roles/permissions each needs, then notifies the operator to fill them in. Acceptance flows in R3–R7 run after the operator fills them. → verify: the rows exist in Settings › Credentials with that description; the operator confirms they are filled. - AC8.2 Available in dev: the operator (operator-plane org) can use GCP and Azure on the dev CP with no hidden flag; the dev `(default)`/operator setting is ON as part of delivery. → verify: sign in as operator on dev CP, Add node › Your Cloud lists GCP and Azure connections. ## Gate before starting The GCP and Azure adapter children are merged AND their Jaah Deploy to the dev CP succeeded (the credential types must be live on `app.dev.jaah.ai`). If the deploy has not landed, check the latest Jaah Deploy run of develop with `jaah-forge` read verbs; do not proceed until the types appear in Settings › Credentials › Add. ## Scope (Architecture C5 part 1, §7) — console UI only, no code All through the dev console in a browser (Playwright), never CLI/API/SQL (CLAUDE.md hard rule; N9): 1. Create `jaah/test/gcp` (type GCP) with placeholder secret and description: "PLACEHOLDER — paste a service-account key for project <dev project>. Roles: roles/compute.instanceAdmin.v1, roles/compute.networkAdmin, roles/compute.securityAdmin, roles/file.editor, roles/serviceusage.serviceUsageConsumer. APIs: compute.googleapis.com, file.googleapis.com, cloudbilling.googleapis.com. Org policy compute.disableNestedVirtualization off. No iam.serviceAccountUser. Break-glass humans need roles/iap.tunnelResourceAccessor + roles/compute.osAdminLogin." 2. Create `jaah/test/azure` (type Azure) with description: "PLACEHOLDER — paste a service-principal for subscription <dev subscription>. Role: Contributor on the subscription. Resource providers registered: Microsoft.Compute, Microsoft.Network, Microsoft.FileShares." 3. Create `jaah/test/aws` from roster credential `gmind/system/gmind-aws` (check `credential_list` first; if missing, ASK with header `Credential`) and one AWS connection on it — never record the value anywhere. 4. Set the dev operator-plane org / `(default)` GCP and Azure "Your Cloud" switches ON in Billing › Plans. 5. Notify the operator (AskUserQuestion, header `Credential`) naming `jaah/test/gcp` and `jaah/test/azure` and the required roles, asking them to fill them in; record the answer. A no-PR settle (`no_code_needed`) with the evidence of what was created is expected. Credentials & reach: Dev console sign-in | `jaah/debug/main/operator-login` (operator; dev CP `app.dev.jaah.ai`) | **verified** by the Architect stage (credential_get succeeded, real browser sign-in left `/login`, value not recorded). AWS regression credential | roster `gmind/system/gmind-aws` | **verified** for the Architect stage; this child's own grant is checked with `credential_list` first; if missing, ASK. GCP/Azure real keys | operator-supplied | **deferred** — this child creates the stubs and asks. Out of scope: Do NOT write any credential VALUE to a file, commit, log, summary, report or question. Do NOT touch Jaah Hosted settings (N1), prod (`app.jaah.ai`), or any plan other than the dev operator/`(default)` rows. Do NOT change code. Do NOT run the R3–R7 oracles (the "Dev oracle run" child does). Done means: - AC10.1 — verify: Settings › Credentials on dev CP lists `jaah/test/gcp` (type GCP) and `jaah/test/azure` (type Azure) with the exact placeholder descriptions and role lists (screenshot in the report, no secret visible); the operator was asked to fill them and the answer is recorded. - AC8.2 — verify: signed in as operator on dev CP, Billing › Plans shows GCP and Azure "Your Cloud" ON for the operator/`(default)` row, and Add node › Your Cloud's provider picker lists GCP and Azure (screenshot). - `jaah/test/aws` exists with one AWS connection whose reopened form shows resolved subnet/security group (screenshot; no value recorded).

Created jaah/test/gcp and jaah/test/azure stubs and jaah/test/aws with connection jaah-test-aws (subnet/SG resolved), all on dev, Operator org, through the console. (default) plan GCP/Azure Your Cloud ON. Operator notified. GCP/Azure in the provider picker deferred to #8778. Draft #8843 filed. Memory: none applied.