fix(relay): staging director deploys run as relay-dir with rehome identity, and can register one cell's cap (#27118)

Rebased onto main as one commit after its parent squash-merged.

cloud/dev/scripts/relay-deploy-workflow-argv.test.mjs

@@ -40,6 +40,19 @@ function sample(flag) {
   return `sample-${flag}`
 }
 
+// Flags a workflow passes through a bash array (`"${name[@]}"`), from every `name=(...)` it
+// assigns; parsing them all at once is the widest set that workflow can send.
+function arrayArguments(source, name) {
+  const flags = []
+  for (const match of source.matchAll(new RegExp(`\\b${name}=\\(([^)]*)\\)`, 'g'))) {
+    for (const entry of match[1].matchAll(/(--[a-z0-9-]+)\s+("[^"]*"|\S+)/g)) {
+      flags.push([entry[1], entry[2].replace(/^"(.*)"$/, '$1')])
+    }
+  }
+  if (flags.length === 0) throw new Error(`no flags assigned to ${name}`)
+  return flags
+}
+
 function invocations(source, script) {
   const lines = source.split('\n')
   const found = []
@@ -49,6 +62,13 @@ function invocations(source, script) {
     let line = lines[index]
     while (line.trimEnd().endsWith('\\')) {
       line = lines[++index]
+      const array = /^\s*"\$\{([a-z_]+)\[@\]\}"\s*\\?\s*$/.exec(line)
+      if (array) {
+        for (const [flag, value] of arrayArguments(source, array[1])) {
+          argv.push(flag, value.includes('$') ? sample(flag.slice(2)) : value)
+        }
+        continue
+      }
       const match = /^\s*(--[a-z0-9-]+)\s+(.+?)\s*\\?\s*$/.exec(line)
       if (!match) throw new Error(`unparsed ${script} argument line: ${line.trim()}`)
       const [, flag, raw] = match

cloud/dev/scripts/relay-staging-deploy-identity.test.mjs

@@ -223,3 +223,13 @@ test('the identity is exposed through its own outputs', () => {
   assert.match(outputs, /output "github_staging_relay_deploy_workload_identity_provider"/)
   assert.match(outputs, /output "github_staging_relay_deploy_service_account"/)
 })
+
+// Why: relay-deploy-workflow-argv.test.mjs proves the argv parses; this pins the identity it names.
+test('the staging director deploy runs as relay-dir with its rehome identity', () => {
+  const source = workflow('deploy-relay-staging.yml')
+  const start = source.indexOf('node dev/scripts/deploy-relay-blue-green.mjs')
+  const block = source.slice(start, source.indexOf('\n\n', start))
+  assert.match(block, /--runtime-service-account "\$\{DIRECTOR_RUNTIME_SERVICE_ACCOUNT\}"/)
+  assert.match(block, /--rehome-director-service-account "\$\{DIRECTOR_RUNTIME_SERVICE_ACCOUNT\}"/)
+  assert.match(source, /DIRECTOR_RUNTIME_SERVICE_ACCOUNT: orca-cloud-staging-relay-dir@/)
+})