Prove the service-account calendar pattern by hand

The settled Google Calendar design rests on a pattern that is community-established but **not documented by Google**: an Orrey-owned calendar, with a service account granted `writer` via `acl.insert`. No refresh token means nothing to expire. Prove it by hand before building on it.

- [ ] Create the Orrey calendar (owned by the Orrey Google account, never the user's Social calendar).
- [ ] Create a service account; grant it `writer` on that calendar via `acl.insert`.
- [ ] From a throwaway script using service-account credentials only: `events.insert` with a self-minted base32hex id, then insert the same id again and confirm the `409`, then `events.update` on it, then `events.delete`.
- [ ] Record the outcome here and, if the pattern fails, what the fallback is before phase 1 starts.

Secrets stay out of the transcript and out of files: run the script under `op run`.

This closes the "service-account-shared-calendar pattern" item from the unverified list.