fix(functions): grant Genkit monitoring roles after the managed service account exists

[IzaakGough]

Fixes #11123.

• Fold the Genkit monitoring roles into the codebase's required roles. When a codebase using requiresRole contains a Genkit function, discoverSecurityDetails adds roles/monitoring.metricWriter, roles/cloudtrace.agent and roles/logging.logWriter to requiredRoles, and the fabricator grants them through the same grantNewRoles call that creates the managed service account. The first deploy no longer binds roles to an account that does not exist yet.
• Redeploy functions when the declarative security etag changes. The endpoint hash covers source, environment variables and secrets, so an etag change on its own left every function skipped as unchanged with a stale label, and every later deploy repeated the setIamPolicy permission check the mismatch implies. The skip predicate and the source upload check now share one up-to-date test that compares the label as well.
• Skip managed accounts in the prepare-time grant. ensureGenkitMonitoringRoles still runs for a Genkit function on the default or an explicit service account, and now ignores endpoints on a firebase-fn- account.

Verified against a real project: first deploy, unchanged redeploy, upgrade from 15.30.2, adding Genkit to an enrolled codebase, an explicit service account, and opting back out. The one deploy after upgrading redeploys the codebase's functions, as the changelog notes.

[gemini-code-assist]

Code Review

This pull request defers granting Genkit monitoring roles until after the managed service account is created during deployment, moving the call to ensureGenkitMonitoringRoles from the preparation phase to the fabricator's plan application phase. Feedback on this PR highlights that ensureGenkitMonitoringRoles should process both created and updated endpoints (rather than just created ones) to prevent permission errors when upgrading existing functions to use Genkit. This adjustment should be reflected in both the actual deployment path in fabricator.ts and the dry-run path in prepare.ts, along with corresponding updates to the function's parameter names and JSDoc documentation.

[CorieW]

Nice fix.

I'd say before this can be approved, it should be tested for real, to see that things work as expected.

One nit:
Nothing proves the Genkit permissions stay on later deploys, even though that's one of the fix's main claims. Maybe a test would be beneficial here?

Also, one thing to watch for:
Codebases that are already enrolled and have Genkit functions get a new etag on upgrade. That brings in the setIamPolicy check, so CI deployers without IAM admin rights may start failing. Skipped functions keep the old label, so it can keep happening until the source changes. Might be worth a changelog note.