Will this enforce Google Workspace as the login method, or will it only enforce the email address?
Will this enforce Google Workspace as the login method, or will it only enforce the email address?

12345a6c.demo.pages.dev, 12345a6c.demo2.pages.dev, demo.pages.dev , 12345a6c.demo2.pages.dev , demo2.pages.dev, etc.12345a6c.demo.pages.dev?
custom dropdown just lets you choose between free-text and the domain picker from before
*.workers.dev is a no-no

*.pages.dev. 

*.demo.pages.dev and one for demo.pages.dev.*.demo.pages.dev doesn't match demo.pages.dev.With this configuration and Includes subdomains enabled, incoming requests to http://a.example.com/about and http://a.b.example.com/about would also match, in addition to the specified domain with no subdomain (https://example.com/about).
pages.dev from what I can tell.
Full (Strict) and that you have a valid SSL certificate installed on your webserverfull (strict), at the SSL settings on the dashboardFull is fine.12345a6c.demo.pages.dev12345a6c.demo.pages.dev12345a6c.demo2.pages.dev12345a6c.demo2.pages.devdemo.pages.devdemo.pages.devdemo.pages.devdemo2.pages.devcustom*.workers.dev*.pages.dev*.demo.pages.dev*.demo.pages.devpages.devFull (Strict)full (strict)