9e2646701c
- Add roles/compute.instanceAdmin.v1 for soma SA (provision/terminate GCE VMs) - Add roles/iam.serviceAccountUser for soma SA (assign SA to inference VMs) - Add firewall rule: allow TCP 8000 inbound to soma-inference-node tagged VMs - Add soma-node-secret to Secret Manager (GCE startup script auth) - Inject SOMA_NODE_SECRET, GCP_PROJECT_ID, GCP_ZONE, SOMA_PUBLIC_URL into the soma Cloud Run service via env vars