fix: ignore recoveryEmail and recoveryPhone on imported GWS users

These are user-managed fields that shouldn't be touched by IaC.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: dsp

src/google.ts

@@ -89,7 +89,7 @@ MEMBERS.forEach((member) => {
         name: { familyName: member.lastName!, givenName: member.firstName! },
         orgUnitPath: mcpOrgUnit.orgUnitPath,
       },
-      { import: primaryEmail, dependsOn: [mcpOrgUnit] }
+      { import: primaryEmail, dependsOn: [mcpOrgUnit], ignoreChanges: ['recoveryEmail', 'recoveryPhone'] }
     );
     provisionedUsersByEmail[primaryEmail] = user;
   } else {