fix(functions): clean up managed service accounts on declarative opt-out during filtered multi-codebase deploys

[ajperel]

Description

When deploying multiple codebases where one codebase opts out of declarative security while another codebase uses a partial function filter (e.g. --only functions:codebaseA,functions:codebaseB:funcB), prepare.ts scoped its partial-filter check to codebaseA, discovering the unenrollment and updating functions to remove declarative labels and IAM bindings.

However, planner.ts checked function filters globally across all codebases. This marked codebaseA as partially filtered, suppressing deletion of the managed service account and permanently orphaning it in GCP IAM.

This change:

• Extracts isCodebasePartiallyFiltered(codebase, filters) into functionsDeployHelper.ts to share consistent codebase-scoped partial-filter evaluation across discovery (prepare.ts) and planning (planner.ts).
• Updates the deployment planner to scope partial-filter checks to the target codebase, ensuring the managed service account is deleted during opt-out unless that specific codebase is partially filtered.

Scenarios Tested

• Unit tests:
  • src/deploy/functions/functionsDeployHelper.spec.ts: Added tests for isCodebasePartiallyFiltered covering undefined/empty filters, full codebase filters, foreign codebase partial filters, matching partial filters, and wildcard partial filters.
  • src/deploy/functions/release/planner.spec.ts: Added regression test verifying that opting out of a whole codebase alongside a filtered codebase deploy schedules the managed service account for deletion.
• npm test

Sample Commands

firebase deploy --only functions:codebaseA,functions:codebaseB:funcB
firebase deploy --only functions:codebaseA

[gemini-code-assist]

Code Review

This pull request introduces a fix to clean up managed service accounts when opting out of declarative security alongside a filtered codebase deploy. It extracts the logic to check if a codebase is partially filtered into a helper function isCodebasePartiallyFiltered in functionsDeployHelper.ts, which is then utilized in both prepare.ts and planner.ts. Unit tests have been added to verify this helper function and the updated planner behavior. There are no review comments, and I have no additional feedback to provide.