Does my data have to live in a Google bucket to be accessible to FireCloud?
Technically yes, although it does not need to live in the Google bucket owned by the workspace you are working in. Data copies (both explicit and through workspace cloning) are shallow: references are copied rather than creating new instances of the data objects. This leads to workspaces containing references to data in buckets external to the workspace.
Note, however, that the results of any analysis run within a workspace will be written to the bucket attached to the workspace.