=== G3 domain-manager persona probe (throwaway domain: g3-probe-20260806-235541) ===
--- PASS group (manager, own domain) ---
  OK:   manager created a user in its own domain
  OK:   manager created a project in its own domain
  OK:   manager granted 'member' on a project in its own domain
  OK:   manager granted 'load-balancer_member' on a project in its own domain
--- DENY group (manager, must be refused) ---
  OK:   anti-escalation held: grant of 'manager' refused
  OK:   cross-domain isolation held: read of admin_domain refused
--- UNAFF group (cloud-admin) ---
  OK:   cloud-admin sees all domains (4 >= 3)
=== verdict: 7 ok / 0 fail ===
G3 PASS -- persona works and is bounded
=== teardown (throwaway domain g3-probe-20260806-235541) ===
  teardown attempted (best-effort; verify with 'openstack domain list')