fix(dev): stop transient stg-global V2 racing the shared rollout for Entra apps

dev-infrastructure/configurations/geneva-identities-stg.tmpl.bicepparam

@@ -5,6 +5,14 @@ using '../templates/geneva-identities.bicep'
 
 param genevaActionsCertificateDomain = '{{ .geneva.actions.certificate.san }}'
 param genevaActionApplicationUseSNI = {{ .geneva.actions.application.useSNI }}
-param genevaActionApplicationManage = {{ .geneva.actions.application.manage }}
+// Coexistence: the Geneva Actions Entra app is environment-scoped (arohcp-ga-stg)
+// and is managed by both the canonical stg global rollout and this transient V2
+// rollout. Both set the same fixed entraAppOwnerIds, so app ownership races between
+// them: whichever ran last owns it, and the other rollout's deploy identity (which
+// only holds Application.ReadWrite.OwnedBy) then fails to manage it with
+// Authorization_RequestDenied. This regressed the V2 rollout after a run where it
+// had briefly owned the app. The V2 global rollout does not consume this app, so
+// skip managing it here to end the tug-of-war. Revisit at decommission.
+param genevaActionApplicationManage = false
 param genevaActionApplicationName = '{{ .geneva.actions.application.name }}'
 param entraAppOwnerIds = '{{ .entraAppOwnerIds }}'

dev-infrastructure/configurations/mise-identity-stg.tmpl.bicepparam

@@ -0,0 +1,15 @@
+// TRANSIENT: STG-global "V2" copy of mise-identity.tmpl.bicepparam. Removed at decommission.
+//
+// Coexistence: the MISE Entra app is environment-scoped (arohcp-mise-stg) and is
+// managed by both the canonical stg global rollout and this transient V2 rollout.
+// Both set the same fixed entraAppOwnerIds, so app ownership races between them:
+// whichever ran last owns it, and the other rollout's deploy identity (which only
+// holds Application.ReadWrite.OwnedBy) then fails to manage it with
+// Authorization_RequestDenied. The V2 global rollout does not consume this app
+// (the stg svc rollout looks it up independently), so skip deploying it here to end
+// the tug-of-war. Revisit at decommission.
+using '../templates/mise-identity.bicep'
+
+param miseApplicationName = '{{ .mise.applicationName }}'
+param entraAppOwnerIds = '{{ .entraAppOwnerIds }}'
+param miseApplicationDeploy = false

dev-infrastructure/global-pipeline-stg.yaml

@@ -279,7 +279,7 @@ resourceGroups:
   - name: mise-identity
     action: ARM
     template: templates/mise-identity.bicep
-    parameters: configurations/mise-identity.tmpl.bicepparam
+    parameters: configurations/mise-identity-stg.tmpl.bicepparam
     deploymentLevel: ResourceGroup
   - name: housekeeping
     action: Shell