fix(0-bootstrap): take the organization id explicitly in import.sh

[scottonix]

Description

fast/stages-aw/0-bootstrap/import.sh assigns the organization from gcloud organizations list --format='value(ID)', which prints one line per organization the caller can see. For any deployer with access to more than one organization — a consultancy account, a shared automation identity — ORG becomes a multi-line string that is spliced into every policy resource name, and the generated imports.tf references organizations that do not exist.

import.sh now takes the organization id as its first argument or from ORGANIZATION_ID, and only falls back to gcloud organizations list when exactly one organization is visible; with several it exits with a message naming them instead of generating bad imports. scripts/deploy.sh passes ${ORGANIZATION_ID}, exactly as it already does for setIAM.sh and enableServices.sh.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Deployment & Compliance Impact

• Applicable Regimes:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Moderate
  • FedRAMP High
  • DoD IL4
  • DoD IL5
  • General / All
• NIST 800-53r5 Controls: none affected (the script only generates import blocks for the org policies the stage already manages).

Checklist

Code Quality & Reusability

• My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
• I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
• My code follows the established naming conventions outlined in documentation/naming-convention.md.

Documentation

• I have updated the README.md of the modified module or blueprint. (The README does not describe import.sh's inputs; the comment in the script now does.)
• I have added/updated documentation for inputs (variables) and outputs.

Security

• My change adheres to GCP security best practices and the principle of least privilege.
• I have ensured compliance with the targeted regime (FedRAMP Moderate, FedRAMP High, IL5, etc.).

Testing

• I have tested my changes locally.
• I have included details of my testing in this PR.

Testing Performed

• bash -n and shellcheck (all severities) on import.sh: clean, before and after.

• The organization-selection block was exercised against a stub gcloud on PATH:

  case	result
  first argument given	ORG = the argument, gcloud not consulted
  ORGANIZATION_ID set, no argument	ORG = the variable
  neither, one organization visible	ORG = that organization
  neither, two organizations visible	exits 1: more than one organization is visible (111 222). Pass the organization ID as the first argument or set ORGANIZATION_ID.
  neither, none visible	exits 1: Failed to get organization ID. (unchanged message)

• Observed originally on a deployment whose deployer could see two organizations: the previous script produced a two-line ORG and an imports.tf with malformed ids.