Give the view group ViewOnlyAccess in every account without a data-plane read or an assume-role path, and include the stack on the management deploy job.
