The setup script that quietly held admin

## Spark

A Grafana credential-setup script authenticated with a Secret Manager admin token. Filed and closed the same day, swapped for gcx — while the surrounding work was moving Grafana's state out of the instance and into git.

## Why it could be interesting

Bootstrap scripts are where over-broad credentials survive longest, because they run rarely, run interactively, and feel like setup rather than infrastructure — the same reasons they escape the review that any committed Terraform gets. The claim: the durable fix isn't rotating the token, it's removing the category — a bootstrap step that can't hold a credential at all because it borrows one from something that already brokers identity. Same-day close is the evidence it was cheap once named.

## Open questions

- [ ] What surfaced it? A drift check, a docs pass, an unrelated read of the script — the trigger decides whether this is a security post or a "what counts as infrastructure" post.
- [ ] Does the gcx swap actually remove the admin capability, or relocate it? Needs the before/after stated precisely, not gestured at.
- [ ] Is "bootstrap scripts escape infrastructure review" a claim the repo can evidence more than once, or is this a single incident?
- [ ] Overlap with #203 (security posture for a one-person cloud) and #230 (matching secret storage to how credentials get stolen) — sibling, subset, or duplicate?

## Source material

- alunduil/alunduil-infrastructure#494 (opened and closed 2026-09-11)
- alunduil/alunduil-infrastructure#88 → PR https://github.com/alunduil/alunduil-infrastructure/pull/496
- alunduil/alunduil-infrastructure#482 (dashboards in git), #497 (Renovate tracks the pinned plugin version)
- alunduil/alunduil-infrastructure#252 (tuned security alerts from GCP audit signals)
- Adjacent: #203, #230