31 tasks across 6 PRs implementing the design spec. Each task has
explicit file paths, code blocks, validation commands, and commit
messages. Self-review checks complete.

Co-authored-by: Isaac

Adds modules/gcp/Makefile mirroring the modules/ pattern (discover
sub-projects via */README.md) and updates modules/Makefile to recurse
into the gcp/ subdir for terraform-docs generation.

Co-authored-by: Isaac

Adds modules/gcp/network module supporting three VPC provenance modes:
- vpc_source="create": Terraform creates spoke VPC + subnet + Cloud Router + NAT
- vpc_source="existing": data-source lookup for pre-existing VPC + subnet
- create_hub=true: adds hub VPC + subnet + bidirectional peering + optional
  shared-VPC host/service binding

Outputs cover all spoke and hub identifiers. Test fixtures in tests/
cover create, existing, and create-with-hub scenarios.

Co-authored-by: Isaac

Adds modules/gcp/private-connectivity with:
- Dedicated PSC subnet in spoke VPC
- Backend (SCC) PSC endpoint gated on enable_backend
- Frontend PSC endpoint (spoke) gated on enable_frontend
- Hub-side frontend PSC endpoint when hub present + frontend enabled
- Regional PSC service-attachment maps for 14 GCP regions
- Egress firewall stack gated on restrict_egress: deny-egress (priority
  1100), allow Google APIs, allow Databricks control plane (to PSC IPs),
  optional allow managed Hive, hub ingress from spoke CIDR

Test fixtures: full-isolated and no-egress.

Co-authored-by: Isaac

Adds modules/gcp/account housing all databricks_mws_* resources:
- databricks_mws_workspaces (always emitted)
- databricks_mws_networks (when vpc_source != databricks_managed),
  with dynamic vpc_endpoints block populated when both PSC endpoint
  IDs are present
- databricks_mws_vpc_endpoint frontend/backend/transit, each gated
  on its enable_* flag plus presence of the matching forwarding-rule
  name from private-connectivity
- databricks_mws_private_access_settings (when private_access_only)

Test fixtures: databricks-managed, byovpc, psc-with-pas.

Co-authored-by: Isaac

Adds modules/gcp/dns for restricted-egress private DNS:
- Hub zones: gcp.databricks.com, gcr.io, googleapis.com, pkg.dev,
  with workspace/psc-auth/dp records pointing at hub PSC IP
- Spoke zone: gcp.databricks.com with workspace/dp records pointing
  at spoke frontend PSC IP, and tunnel record at backend PSC IP
- workspace_dns_id extracted via regex from workspace_url

Split into its own submodule (rather than colocated with PSC) because
DNS depends on workspace_url which only exists after account creates
the workspace; this keeps the composer's dependency graph linear.

Test fixture: hub-and-spoke.

Co-authored-by: Isaac

Top-level composer that orchestrates network, private-connectivity,
account, and dns submodules through orthogonal feature flags:
- vpc_source: databricks_managed | create | existing
- private_link_frontend, private_link_backend, private_access_only,
  restricted_egress (each defaults false)
- hub/spoke project + CIDR vars required only when restricted_egress

Submodules instantiated conditionally:
- network when vpc_source != databricks_managed
- private-connectivity when any PrivateLink flag is true
- account always
- dns when restricted_egress is true

Cross-variable preconditions (null_resource.preconditions) enforce
six rules from the design spec, including: restricted_egress requires
vpc_source=create + at least one PrivateLink flag + hub/CIDR vars;
databricks_managed forbids any PrivateLink or restricted_egress.

Random suffix declared once in the composer, passed to each submodule.

Test fixtures: 4 positive (basic, byovpc, existing-vpc, psc-isolated)
and 4 negative (each violating one precondition rule).

Co-authored-by: Isaac

git mv only; no functional changes. Old path has a deprecation README
pointing to the new location. Makefile updated for new depth.

Co-authored-by: Isaac

git mv only; no functional changes. Old path has a deprecation README.

Co-authored-by: Isaac

Generated README content for network, private-connectivity, account,
dns, databricks-workspace, service-account, and unity-catalog via
`make -C modules/gcp docs`. Includes an added README placeholder for
unity-catalog (the original modules/gcp-unity-catalog had no README).

Co-authored-by: Isaac

Migrates all four existing GCP examples to call modules/gcp/databricks-workspace:
- gcp-basic: vpc_source="databricks_managed"
- gcp-byovpc: vpc_source="create" with spoke_vpc_cidr + subnet_cidr
- gcp-with-psc-exfiltration-protection: vpc_source="create" + all 4
  PrivateLink/egress flags + Unity Catalog wired via modules/gcp/unity-catalog
- gcp-sa-provisioning: source repointed from github URL to
  ../../modules/gcp/service-account

Adds a NEW example examples/gcp-existing-vpc demonstrating
vpc_source="existing" (data-source lookup of a pre-existing VPC + subnet).

Variable name changes documented in each example's README migration table:
subnet_ip_cidr_range -> subnet_cidr, pod/svc renames, subnet/router/nat_name
dropped (composer derives), delegate_from dropped (SA-provisioning concern).

State from old applies does NOT migrate cleanly because resource addresses
differ. Re-apply on clean state.

Co-authored-by: Isaac

Deletes:
- modules/gcp-workspace-basic, modules/gcp-workspace-byovpc,
  modules/gcp-with-psc-exfiltration-protection (replaced by the composer
  + submodules under modules/gcp/)
- modules/gcp-sa-provisioning, modules/gcp-unity-catalog deprecation stubs
  (relocated to modules/gcp/{service-account,unity-catalog} in PR 1's
  foundation commit)
- examples/gcp-sa-provisionning (typo dir, only had a Makefile)
- examples/gcp-test-modules (only contained terraform.tfstate files)

All examples now point at modules/gcp/*. Stray terraform.tfstate* files
inside remaining example dirs are gitignored and remain on disk untouched.

Co-authored-by: Isaac

Examples section now lists all four migrated examples (gcp-basic,
gcp-byovpc, gcp-with-psc-exfiltration-protection) plus the new
gcp-existing-vpc and the corrected-spelling gcp-sa-provisioning.

Modules section now lists the modules/gcp/ tree: the composer
(databricks-workspace) and its five submodules (network,
private-connectivity, account, dns, plus service-account and
unity-catalog).

Co-authored-by: Isaac