Deploying a Gen2 Cloud Function (Pub/Sub trigger) on a fresh GCP project fails at 3 sequential stages — build SA role, startup OOM, Eventarc run.invoker

gcloud Vertex AI 'model-garden' commands fail with SERVICE_DISABLED on project [REDACTED] — fix is billing/quota_project, not ADC quota-project