onCallGenkit functions fail on initial deploy when using declarative security support

[bigjimhere]

[REQUIRED] Environment info

firebase-tools:

15.30.2

Platform:

macOS

[REQUIRED] Steps to reproduce

Attempt to deploy an onCallGenkit function during the initial functions deploy for a project that is using the new declarative security support feature.

[REQUIRED] Expected behavior

Deploying onCallGenkit functions works during the initial deploy for a project using declarative security support.

From my agent:
ensureGenkitMonitoringRoles (called from prepare.ts) needs to either run after the fabricator creates the managed account or skip accounts that declarative security is about to create.

[REQUIRED] Actual behavior

Errors outlining missing IAM roles on the initial deploy.