I suppose a very hacky workaround is
(1) to not use “auth overrides email” and instead use the user api not the sso api to set the user email.
(2) hide the email editing ui using a theme component
@sam is this pr-welcome for a proper fix to allow alternate emails to be set by discourse connect?