[FEATURE] Claude Apps Gateway to use container service account credential for google group oidc lookup

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Currently the Claude Apps Gateway requires service_account_json_path to retrieve users' google group membership when configured for Google Workspaces OIDC. However, when the gateway is running in GCP, it will already have a service account for the runtime and already knows how to get the credential without further configuration. But service_account_json_path is required, and when unspecified the gateway will error on startup:

claude gateway: [
    {
        "code": "invalid_type",
        "expected": "string",
        "received": "undefined",
        "path": [
            "oidc",
            "google_groups",
            "service_account_json_path"
        ],
        "message": "Required"
    }
]

That means we need to generate a key-based credential for the service account, even though the app already knows how to get the credential from the runtime. Org policy blocks key-based credentials as part of the "Secure by Default enforcments", which adds friction to the deployment.

Proposed Solution

Use the service account for the container runtime, which it already has a credential for, instead of requiring service_account_json_path.

Alternative Solutions

_No response_

Priority

Critical - Blocking my work

Feature Category

CLI commands and flags

Use Case Example

_No response_

Additional Context

_No response_