Both writes to Networks (the stale-iaas_gateway_id self-heal, and the
final assignment once provisioning succeeds) are instance ->update()
calls, which fire NetworksObserver's saving()/updating() hooks - those
run a UserHelper::can() authorization check. This action runs on the
iaas queue, a separate worker process with no authenticated session of
its own, so that check had nothing to authorize against and failed
with "You are not allowed to save this record", even after the
self-heal guard itself worked correctly.

Wrapping both writes in UserHelper::runAsAdmin() sidesteps this the
same way other internal, system-triggered writes in this codebase do,
without trying to reconstruct the original dispatching user's context.