Lifecycle step 8 (1/4): grp-helpdesk planner

[rachmo]

Step 8, part 1 of 4: the pure planner. Nothing reads or changes Google yet. The scope is in #64; this PR does not depend on it.

src/domain/lifecycle/helpdesk.ts

• planHelpdesk: who should be in grp-helpdesk (Active Mentor, Help Desk Admin row on Mentor_Admin_Roles, CORI current), against who is.
  • add: by RHR Email, only if Google has a working account for that address.
  • remove (by Apply): an Active Mentor whose row is gone or whose CORI lapsed, and any address that is no sheet person's.
  • held: someone leaving the team (Inactive, status unknown, no longer a Mentor). Their own leaving alert's Remove from groups already reaches every group in the Workspace.
  • waiting: has the row but can't be added yet (no CORI, no RHR Email, or the address is not an account, is suspended, or is an alias).
  • staleRows: a Help Desk row left on someone who has left. It's harmless until they come back, and then it would bring the role back with them (still only on a click).
• decideHelpdesk: applies nothing to a missing group or an ID that leads to another group. There is no "refused" plan: the group is a handful of people, emptying it is legitimate, and every change is a click.
• planAdmins: every Super Admin (with suspended ones marked); every delegated admin that grp-helpdesk doesn't explain, never hawk-mod@ itself; and members Google does not flag as admins. That last list is how the dry run (PR 2) will show whether Google flags a role that comes through a group.

sheet.ts: Groups Admin is no longer an admin role. A row still naming it is a sheet problem: "Groups Admin is no longer given out; delete the row".

Tests: 22 new, 863 in total, using plain objects. They cover each add, remove, hold and wait case; matching by an account's primary address when the RHR Email is an alias; the wrong and missing group; and each admin case.

Next: PR 2 reads grp-helpdesk by ID and keeps Google's two admin flags apart (today they're merged into one), behind a /hawkmod lifecycle helpdesk dry run. It needs the group's ID from Rachel's Google setup.

🤖 Generated with Claude Code