• Hash-enforced installs: evergreen/external_auth_gcp_requirements.txt gains sha256 -hash entries for every artifact of all 20 pins (generated with uv pip compile --generate-hashes --universal), and setup_gcp_venv installs with require-hashes --only-binary=:all:, so index content outside the repo's committed wheels fails before it can run while GCP credentials are on disk. only-binary is needed because -require-hashes does not cover the build dependencies pip downloads when building an sdist under PEP 517 build isolation.
• Teardown credential cleanup): evergreen/external_auth_gcp_teardown.sh previously ran the VM delete under errexit before key removal, so a failed install or delete left the SSH and service-account keys on the CI host. The delete now runs in a subshell, the keys are always removed, and the failure status is preserved so a failed teardown stays visible in Evergreen. (The subshell status is captured with errexit temporarily disabled — ( ... ) || status=$? silently suppresses errexit inside the subshell.)

Tests

• evergreen/external_auth_gcp_test.sh: pip stub rejects installs without -require-hashes/-only-binary=:all:; delete stub requires the service-account key at delete time; teardown failure cases assert both keys are removed and the exit stays non-zero.
• buildscripts/tests/test_external_auth_gcp_requirements.py (new): static checks that entry scripts install nothing themselves and the helper install is hash-enforced, wheel-only, and fully pinned.

Both verified red against the pre-fix scripts and green after.