[hkonsti]

Prep for Google's restricted-scope verification. Google turns down any scope the app doesn't visibly use, and every scope has to appear in the demo video. So this PR settles the scope list before we submit.

Removed: documents, spreadsheets and presentations. The Docs and Slides APIs were never called, and Sheets requests already go through drive, which those three APIs also accept.

Added, each a sensitive scope with the actions that use it:

Scope	Action (group)	Tool
calendar.events.freebusy	See when people are free (Calendar)	availability_check
contacts.other.readonly	Read other contacts (Contacts)	other_contacts_list, _get, _save (saving needs Add and edit contacts)
tasks	Read tasks, Add and edit tasks (Tasks)	tasks_list, _get, _create, _update, _complete, _reopen

• Availability: asks Google's free/busy for the account and the people named, by default from now for a week. It answers each person's busy times and the times all of them are free, on the primary calendar's clock. Someone whose calendar can't be seen is reported as such, never as free.
• Other contacts: the people Gmail saves on its own after you exchange email. They're read-only (name, emails, phone numbers). Save to contacts copies one into Google Contacts. Google has no way to fetch a single other contact by id, so opening one pages through the list, 1,000 at a time.
• Tasks: task lists at the top, each list holding its tasks. A list can be narrowed to tasks to do or done. Tasks can be created (in the default list unless another is named), edited, moved to another list by writing its name, completed and reopened. Nothing is deleted: Tasks has no Trash, so completing is the done path.
• Shared time helpers: the time parsing and time zone arithmetic from google-events.ts moved to calendar-time.ts, so the availability check uses the same code.
• Also updated: the Google docs page (APIs to enable, scopes, the new actions), the privacy policy (names Google Tasks, free/busy times and other contacts; effective date is now October 26, 2026), the env help text, .env.example and the seed.

Existing connections keep working. Their new actions show as "Not allowed at sign-in" until the person signs in to Google again.

Before deploying, in the Cloud project:

• Enable the Google Tasks API.
• On the Data Access page, add calendar.events.freebusy, contacts.other.readonly and tasks, and remove documents, spreadsheets and presentations.
• Check that the three new scopes show as sensitive there, not restricted.

Testing: new unit tests for all three connectors. Typecheck, lint and every package's tests pass, and the docs and website build. These features haven't been run against a live Google account yet.

---

Open workspace in Conductor