GWS user accounts were only created for members whose direct roles had
google.provisionUser (lead/core maintainers, moderators, maintainers,
registry-wg). SDK maintainers and working-group members who opted in by
adding firstName/lastName/googleEmailPrefix (e.g. #148, #150, #152)
silently got no account.

- Move provisionUser from GoogleConfig to the Role level, and add it to
  the implicit-maintainer containers (sdk-maintainers, working-groups)
  plus the standalone maintainer roles (docs, inspector, mcpb,
  reference-servers, use-mcp, server-identity-wg, wg/ig facilitators).
- Eligibility now walks github.parent chains (hasProvisionUserRole),
  matching GitHub team-nesting semantics, so e.g. python-sdk members
  qualify via sdk-maintainers.
- validate-config now errors when a googleEmailPrefix would be a silent
  no-op (no eligible role and not an existing GWS user), so opt-in PRs
  like #150 fail CI instead of quietly doing nothing.

Newly provisioned on next apply: marcelo@, alexhancock@, liad@.
ochafik is now eligible but already has an account (existingGWSUser).