cloud: Standardize service account name passing

It looks like we have three ways we pass around service accounts:
* Just the name, assuming the project is passed separately, and assuming the recipient knows it's a service account.
* The complete email, assuming the recipient knows it's a service account.
* The complete account name, with the `serviceAccount:` prefix.

This makes it difficult to figure out what is passed when without looking at the surrounding code.

See if we can unify that in as many places as possible.

No files, tests, or entry points are named. Start by tracing the three service-account representations across the repository and documenting each affected call path. Done means the representations are unified in as many places as practical, with the remaining exceptions clearly identified and covered by tests where applicable.

Written by the indexing model from the issue text.