[Bug] deploy.sh validates the identity groups twice in one Step-1 run (Identity-step describe + Manual-Steps re-confirm), and the two can disagree

## Bug Description
In `gemini-enterprise/deploy.sh`, the Identity & Access step runs `gcloud identity groups describe` to validate the admin/user groups (~Lines 1706–1722), and the end-of-config `--- Manual Steps ---` gate then asks the operator to confirm the same groups were created — a second time. The two checks are redundant, and they can disagree: the Identity-step `describe` warns "Cannot access or find" whenever `cloudidentity` is not enabled, while the Manual-Steps gate is a blind self-attestation, so an operator can pass the gate while the programmatic check "failed."

## Environment and Deployment Context
* **Stellar Engine Version/Commit:** `main` @ `3728fc98`
* **Deployment Type:**
* [ ] US Region Restricted (e.g., Access Policy constraint)
* [ ] FedRAMP Medium
* [x] FedRAMP High
* [ ] DoD IL4
* [ ] DoD IL5
* [ ] Stand-alone / Custom
* **Affected Component:** `blueprints/fedramp-high/gemini-enterprise/deploy.sh` — Identity-step group validation (~Lines 1706–1722) and the `--- Manual Steps ---` "User Role Groups: Created…" confirm at Step-1 end

## Steps to Reproduce
1. Run `./deploy.sh` (Brownfield, Step 1).
2. Observe the Identity step run `gcloud identity groups describe` on both groups.
3. At the end-of-config Manual Steps gate, observe a second prompt asking you to confirm the same groups exist.

## Expected Behavior
Consolidate to a single authoritative check: make the Identity-step validation authoritative (after `cloudidentity` is enabled), or drop the group item from the Manual-Steps gate (keeping only the OAuth-consent-screen item there).

## Actual Behavior
The same groups are validated twice per run; because the programmatic check is unreliable without `cloudidentity`, the two can disagree, and the Manual-Steps self-attestation can mask a real failure.

## Relevant Logs and Errors
```
[Identity step] gcloud identity groups describe @... (WARNING: Cannot access or find ... if cloudidentity off)
...
--- Manual Steps ---
User Role Groups: Created? [y/N]
```

Read blueprints/fedramp-high/gemini-enterprise/deploy.sh around the Identity-step group validation at lines 1706–1722 and the end-of-config Manual Steps gate. Run ./deploy.sh for a Brownfield Step-1 deployment to observe both checks. Done means the groups have one authoritative validation and the duplicate self-attestation no longer runs, while the OAuth consent-screen item remains.

Written by the indexing model from the issue text.