Verify gke cluster deletion / recreation and reacquire of deployed resources (at least core-landing-zone) - for FinOps or non-drift requirements

For usually the FinOps case a developer or client wishes to shutdown the GKE cluster and behave like we used to with terraform - only use the IaC intent engine during actual changes.
For sparse use cases where GCP infrastructure is rarely modified and drift protection is not required - keep the GKE cluster off

We will use the script from #446 or #766
and document on the staging wiki from this issue
```
./setup.sh -b kcc-oi -u ar -n false -c false -l false -h false -d true -j true -p kcc-oi-6475

delete/reassociate
gcloud anthos config controller delete --location $REGION $CLUSTER --quiet

create
gcloud anthos config controller create $CLUSTER --location $REGION --network $NETWORK --subnet $SUBNET --master-ipv4-cidr-block="172.16.0.128/28" --full-management
gcloud anthos config controller get-credentials $CLUSTER --location $REGION
gcloud anthos config controller list
SA_EMAIL="$(kubectl get ConfigConnectorContext -n config-control -o jsonpath='{.items[0].spec.googleServiceAccount}' 2> /dev/null)"
echo "post GKE cluster create - applying 2 roles to org: ${ORG_ID} and project: ${KCC_PROJECT_ID} on the yakima gke service account to prep for kpt deployment: $SA_EMAIL"
gcloud organizations add-iam-policy-binding "${ORG_ID}" --member="serviceAccount:${SA_EMAIL}" --role=roles/resourcemanager.organizationAdmin --condition=None --quiet > /dev/null 1>&1
gcloud projects add-iam-policy-binding "${KCC_PROJECT_ID}" --member "serviceAccount:${SA_EMAIL}" --role "roles/serviceusage.serviceUsageConsumer" --project "${KCC_PROJECT_ID}" --quiet > /dev/null 1>&1
# need service account admin for kubectl describe iamserviceaccount.iam.cnrm.cloud.google.com/gatekeeper-admin-sa
# Warning UpdateFailed 36s (x9 over 6m44s) iamserviceaccount-controller Update call failed: error applying desired state: summary: Error creating service account: googleapi: Error 403: Permission 'iam.serviceAccounts.create' denied on resource (or it may not exist).
##roles/iam.serviceAccountCreator
gcloud organizations add-iam-policy-binding "${ORG_ID}" --member="serviceAccount:${SA_EMAIL}" --role=roles/iam.organizationRoleAdmin --condition=None --quiet > /dev/null 1>&1
gcloud organizations add-iam-policy-binding "${ORG_ID}" --member="serviceAccount:${SA_EMAIL}" --role=roles/iam.serviceAccountAdmin --condition=None --quiet > /dev/null 1>&1

```

see also #818 #817