feat(demos): add GCP Cloud Armor sync demo tape and gif

demos/fixtures/gcp-demo-local.doorman.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://doorman.griffen.codes/schema.json",
+  "version": "2.0",
+  "provider": "gcp",
+  "providers": {
+    "gcp": { "projectId": "demo-project", "policyName": "doorman-demo-policy" }
+  },
+  "rules": [
+    {
+      "id": "1000",
+      "name": "Block Bad Bots",
+      "description": "Block Bad Bots",
+      "enabled": true,
+      "conditions": [{ "field": "user_agent", "operator": "contains", "value": "bot" }],
+      "action": { "type": "deny" },
+      "priority": 1000
+    },
+    {
+      "name": "Block Admin Access",
+      "enabled": true,
+      "conditions": [{ "field": "path", "operator": "starts_with", "value": "/admin" }],
+      "action": { "type": "deny" }
+    }
+  ],
+  "ips": []
+}

demos/fixtures/gcp-demo-remote.json

@@ -0,0 +1,17 @@
+{
+  "projectId": "demo-project",
+  "policyName": "doorman-demo-policy",
+  "policyId": "1234567890",
+  "rules": [
+    {
+      "priority": 1000,
+      "description": "Block Bad Bots",
+      "match": {
+        "expr": {
+          "expression": "(has(request.headers['user-agent']) && request.headers['user-agent'].contains('bot'))"
+        }
+      },
+      "action": "deny(403)"
+    }
+  ]
+}

demos/tapes/gcp-sync.tape

@@ -0,0 +1,35 @@
+Source demos/tapes/_setup.tape
+Set Width 1900
+Set Height 700
+
+Output assets/demos/gcp-sync.gif
+
+# Unlike the other providers' tapes, this one can't be fully offline: GCP's
+# GoogleAuth still mints a real OAuth2 access token against Google's real
+# infrastructure (using the recorder's own `gcloud auth application-default
+# login` session) even though the actual securityPolicies request/response
+# traffic below is routed to the local mock server. Re-recording this tape
+# requires live GCP credentials — see skills/doorman/references/gcp.md's
+# "Manual End-to-End Verification" section.
+Hide
+Type "pkill -f 'cloudarmor-mock-server.mjs --port 4867' 2>/dev/null; true" Enter
+Type "MOCK_SERVER=$(pwd)/demos/cloudarmor-mock-server.mjs" Enter
+Type "MOCK_FIXTURE=$(pwd)/demos/fixtures/gcp-demo-remote.json" Enter
+Type "LOCAL_SEED=$(pwd)/demos/fixtures/gcp-demo-local.doorman.json" Enter
+Type "REPO_BIN=$(pwd)/bin/run" Enter
+Type "node $MOCK_SERVER --port 4867 --fixture $MOCK_FIXTURE > /dev/null 2>&1 & MOCKPID=$!" Enter
+Type "sleep 1" Enter
+Type "export DOORMAN_GCP_API_BASE_URL=http://127.0.0.1:4867" Enter
+Type "mkdir -p demos/.fixtures/gcp-sync && cd demos/.fixtures/gcp-sync && cp $LOCAL_SEED .doorman.json && clear" Enter
+Type "alias doorman=$REPO_BIN" Enter
+Type "clear" Enter
+Show
+
+Type "doorman sync" Enter
+Sleep 3000ms
+Enter
+Sleep 3000ms
+
+Hide
+Type "kill $MOCKPID 2>/dev/null" Enter
+Show

skills/doorman/SKILL.md

@@ -76,7 +76,7 @@ FASTLY_WORKSPACE_ID=workspace_xxx
 }
 ```
 
-For Cloudflare or Fastly, add `provider` and `providers` fields instead of `projectId`/`teamId` — and note this switches the *rule* shape too, not just the top-level fields. See [Rule Shape](#rule-shape-minimal) below.
+For Cloudflare or Fastly, add `provider` and `providers` fields instead of `projectId`/`teamId` — and note this switches the _rule_ shape too, not just the top-level fields. See [Rule Shape](#rule-shape-minimal) below.
 
 ## Core Workflow
 
@@ -137,14 +137,14 @@ Two different rule shapes, picked by whether the config has `provider`/`provider
 
 Load the relevant reference file for detailed documentation:
 
-| Task                                                                                        | Reference                                            |
-| ------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
-| Writing rules — full field docs, operators, actions, IP blocking, patterns                  | [references/rules.md](references/rules.md)           |
+| Task                                                                                           | Reference                                            |
+| ---------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| Writing rules — full field docs, operators, actions, IP blocking, patterns                     | [references/rules.md](references/rules.md)           |
 | Cloudflare-specific setup, Lists API, managed rule groups, expression translation, limitations | [references/cloudflare.md](references/cloudflare.md) |
-| Fastly-specific setup, condition/action mapping, rate-limit signal requirement, limitations | [references/fastly.md](references/fastly.md)         |
-| GCP Cloud Armor setup, CEL translation, priority model, manual e2e verification runbook     | [references/gcp.md](references/gcp.md)                |
-| Available templates and what they protect against                                           | [references/templates.md](references/templates.md)   |
-| CI/CD integration, automation, export formats, validation in pipelines                      | [references/cicd.md](references/cicd.md)             |
+| Fastly-specific setup, condition/action mapping, rate-limit signal requirement, limitations    | [references/fastly.md](references/fastly.md)         |
+| GCP Cloud Armor setup, CEL translation, priority model, manual e2e verification runbook        | [references/gcp.md](references/gcp.md)               |
+| Available templates and what they protect against                                              | [references/templates.md](references/templates.md)   |
+| CI/CD integration, automation, export formats, validation in pipelines                         | [references/cicd.md](references/cicd.md)             |
 
 ## Principles