Deploying a Gen2 Cloud Function (Pub/Sub trigger) on a fresh GCP project fails at 3 sequential stages — build SA role, startup OOM, Eventarc run.invoker

On a freshly-provisioned GCP project, gcloud functions deploy --gen2 --trigger-topic=... fails three times in a row, each at a different stage, with errors that don't obviously point at the fix. You fix one, redeploy, and hit the next. This burns a lot of time if you don't know the chain up front.