Deploying a Gen2 Cloud Function (Pub/Sub trigger) on a fresh GCP project fails at 3 sequential stages — build SA role, startup OOM, Eventarc run.invoker