Can I rely on using sa.Email after calling serviceaccount.NewAccount? Or does that run asynchronously and populate sa with promise-like values?

Yes, passing an output from one resource as an input to another resource creates a dependency between them implicitly

If I can use sa.Email where I have it, how do I convert this pulumi.StringOutput to String?

You cannot convert a

pulumi.StringOutput

to a

String

- you need to resolve the value using

ApplyT

and then use the string. See https://leebriggs.co.uk/blog/2021/05/09/pulumi-apply for more information