[origincloud-regenerate]

Moves to origincloudhq/api@992b5bdeca9c (changes), but generation fails, so this moves the Rust SDK and API_REVISION alone and leaves the generated code as it was. scripts/update.sh said:

origincloudhq/mcp@7c3bf43ad7f5, origincloudhq/sdk-rust@5a673315cba8, origincloudhq/api@992b5bdeca9c
warning: the package origincloud.iam.v1beta1 has several services, so its group's help needs a [[service]] entry, name = "iam", in generator/commands.toml; until then it reads "The iam service"
Error: the service iam replaces the hand-written `origin iam`: retire that group in this change, take it off `hand_written` in generator/commands.toml, and list each of its commands nothing of the same name replaces under [[retired]] (CONTRIBUTING.md, "A service replacing a hand-written group")

Extend the generator (generator/) on this branch, or leave the method or the field out in generator/commands.toml with the reason, and run scripts/generate.sh. Commits added here are kept by later runs, which generate with them.

Retiring the hand-written origin iam

Added on this branch: main (with #32) merged in, and the switch CONTRIBUTING.md describes, so origin iam is now the generated group.

• Removed: handler/iam/, the Iam variant and its arm, every iam GraphQL query but the current user's, and the identifier types (OrgId, ProjectId, Principal, Urn) only those queries used.

• Kept: origin id login still reads the signed-in user from the GraphQL API once after a login, because that read applies pending invitations; the REST GetUser doesn't. Its warning on a failed read no longer names origin iam current-user: it says to log in again or sign in to the console.

• Views: Show iam members by their email, and the other iam lists by what tells them apart #32's columns, carried over as [[view]] entries:

  Generated list	table columns	From Show iam members by their email, and the other iam lists by what tells them apart #32's
  list-role-bindings	name, member, role, project, createTime	list-members, principal-grants, current-user-grants
  list-service-accounts	name, displayName, member, createTime, deleteTime	list-service-accounts
  list-roles	name, description	list-roles
  list-permissions	name, service, resourceType, action	permissions

  A role shows as its id (owner), a member as user:{email}.

• Secret notice: create-service-account says on standard error that clientSecret is shown this once, as create-key-pair does for privateKey ([[shown_once]]).

• Retired: the 13 commands with no generated command of the same name, each with its replacement in generator/commands.toml. create-service-account, list-service-accounts, get-role and list-roles are generated under the same names; the three invitation commands have no CLI equivalent, since invitations aren't in the API.

Checked locally: everything ci.yml runs.