cmd/

google-workspace-directory-sync pulls the Google Workspace user directory into saas_identities so the Security Graph, the executive report, and the Google Workspace assessment stop reporting 0 privileged identities / 0 active accounts / 0% MFA coverage on real tenants.

google-workspace-oauth-sync pulls per-user OAuth grants from the Google Admin Directory tokens API and upserts them into security_assets + oauth_app_grants so the Shadow IT page stops showing zero OAuth apps for live tenants.

google-workspace-poller pulls Google Workspace audit activities into the shared ingestion_jobs queue so the existing internal/ingestionworker rule evaluators can produce findings.