Sub-ticket of PLUTO-632 Enumerate every session-establishing path, confirm isGenuineGoogleUser enforcement fleet-wide (not just auth/callback) · pluto