Or put another way...
I just moved my app from aaa.appspot.com to a new project (and hence new Client ID) called bbb.appspot.com. When I went to add the new Client Id to my GCE API definitions, it was already there!
So, on the one hand, it's magic :-)
On the other hand, is all of this documented anywhere? I have a slight concern about how I would go about overriding this behaviour if ever I want to manually configure the permitted client IDs.