fix: grant caller iam.serviceAccountUser on AGENT_SA before gcloud run deploy

infrastructure/05-cloudrun-deploy.sh

@@ -31,6 +31,18 @@ gcloud services enable \
   cloudbuild.googleapis.com \
   --project="${PROJECT_ID}" --quiet
 
+# Resolve caller identity
+CALLER=$(gcloud config get-value account 2>/dev/null)
+echo "ℹ️  Deploying as: ${CALLER}"
+
+# Grant caller permission to act as the agent service account
+# (required for gcloud run deploy --service-account=...)
+gcloud iam service-accounts add-iam-policy-binding "${AGENT_SA}" \
+  --member="user:${CALLER}" \
+  --role="roles/iam.serviceAccountUser" \
+  --project="${PROJECT_ID}" --quiet
+echo "✓ iam.serviceAccountUser granted to ${CALLER} on ${AGENT_SA}"
+
 # Create Artifact Registry repo if it doesn't exist
 gcloud artifacts repositories describe osvauco-repo \
   --location="${REGION}" --project="${PROJECT_ID}" &>/dev/null || \
@@ -40,7 +52,7 @@ gcloud artifacts repositories create osvauco-repo \
   --project="${PROJECT_ID}" --quiet
 echo "✓ Artifact Registry repo ready"
 
-# IAM for Cloud Build
+# IAM for Cloud Build compute SA
 PROJECT_NUMBER=$(gcloud projects describe "${PROJECT_ID}" --format="value(projectNumber)")
 COMPUTE_SA="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
 gcloud projects add-iam-policy-binding "${PROJECT_ID}" \