docs(guide): record the bucket public-access policy

[MarkusNeusinger]

Summary

• Documents the anyplot-images IAM change applied 2026-08-19: allUsers swapped from roles/storage.objectViewer (bundles storage.objects.list — the whole bucket, including the unreviewed staging/ prefix, was publicly enumerable) to roles/storage.legacyObjectReader (get-only). Verified live: every render URL still 200 incl. CORS; both listing APIs now denied (401/AccessDenied).
• The runbook entry sits next to the bucket CORS section in agentic/docs/project-guide.md with the re-apply command — bucket IAM does not deploy with the repo, so a rebuild would silently drop it. Changelog entry included.

Plan

Docs-only. The commit raced #10492's squash-merge (same recovery as before: cherry-picked onto merged main, stale branch deleted).

Test plan

• Live verification already done: object GET 200 (light/dark/webp/R/Julia), JSON + XML listing denied, access-control-allow-origin: * intact, allUsers holds only legacyObjectReader

[Copilot]

Pull request overview

Documents an operational IAM change for the public anyplot-images GCS bucket (public object GET remains allowed, but public object listing is blocked) and records it in the repo’s operator-facing project guide and changelog.

Changes:

• Add a project-guide runbook section describing the intended bucket public-access policy and how to re-apply it after a rebuild.
• Add a [Unreleased] changelog entry documenting the IAM change and rationale (prevent public enumeration of staging/).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
CHANGELOG.md	Adds an [Unreleased] entry capturing the bucket IAM change and its motivation/impact.
agentic/docs/project-guide.md	Adds an operator runbook section detailing the bucket’s public-access/listing policy and the re-apply command.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

agentic/docs/project-guide.md:420

• The verification guidance is overly strict about the expected HTTP status code. Google Cloud Storage listing requests can be denied with either 401 or 403 depending on the caller/auth context, so the runbook should assert that listing is denied rather than requiring exactly 401.

Never grant `allUsers` a role that includes `storage.objects.list`. To verify:
an object URL must return 200 anonymously, while
`https://storage.googleapis.com/storage/v1/b/anyplot-images/o` must return 401.