fix: replace authoritative project metadata with non-authoritative items (B1)

[nandajavarma]

Problem

google_compute_project_metadata is an authoritative resource — on first terraform apply it deletes all other project-level metadata (OS Login config, SSH keys, etc.) managed outside this module. This silently destroys customer metadata.

Fix

Replace with google_compute_project_metadata_item resources, which only manage the individual keys this module needs (enable-oslogin, gitpod-runner-id), leaving all other project metadata untouched.

Migration

Existing deployments will see Terraform plan to destroy the google_compute_project_metadata resource and create two google_compute_project_metadata_item resources. The metadata values themselves don't change — only the Terraform resource type managing them.

⚠️ State migration: Customers who have already applied should run:

terraform state rm google_compute_project_metadata.runner_metadata

before the next terraform apply to avoid a brief metadata gap. Alternatively, just apply — the items will be recreated immediately.

Audit reference

Customer security audit item B1.