feat(gcp-cloud-run): support plan protocol v2

[jrusso1020]

Summary

• add explicit, opt-in Plan protocol v2 support to the GCP Cloud Run adapter
• publish a manifest-last, content-addressed GCS artifact graph and verify every downloaded artifact
• materialize only chunk-scoped dependencies; download audio only for assembly
• keep Plan v1 as the default and fail closed on mixed or malformed protocol locators
• add SDK/workflow propagation, v2 sample events, and local contract coverage
• add an owner-isolated real-GCP v1/v2 parity smoke path with fail-closed cleanup

Stack

• based on feat(aws-lambda): support plan protocol v2 #2789 (AWS Lambda Plan v2)
• feat(aws-lambda): support plan protocol v2 #2789 is based on feat(producer): add content-addressed plan v2 #2788 (producer Plan v2)
• feat(producer): add content-addressed plan v2 #2788 is based on feat(producer): version distributed plan protocol #2777 (Plan protocol v1 boundary)

Safety

• no automatic protocol fallback after fan-out
• required GCP APIs are read-only preconditions; the smoke test never enables shared services
• generated repositories fail closed if already present
• image package/tag, Terraform state, service accounts, Cloud Run service, workflow, render bucket, and Cloud Build staging bucket are invocation-scoped
• Cloud Build upload is bounded to 527 files / 6,470,104 bytes
• cleanup deletes and absence-verifies only preflighted owner-scoped resources
• GCP retains only its Cloud Build execution and Cloud Logging/audit history
• the workflow is created only after its service-level Cloud Run invoker grant
• all Cloud Run calls pin the OIDC audience to the service root; only the initial
  plan call gets the longer IAM-propagation horizon, while chunk/assemble keep
  their original retry count

Validation

• 80 GCP adapter/workflow/smoke-safety tests
• GCP package typecheck and build
• oxlint and oxfmt
• Terraform fmt and validate
• shell syntax and tracked-artifact checks
• Fallow change audit: no introduced issues
• independent blocker review approved the owner-scoped live test

Live GCP gate

Environment: hyperframes-dev, us-east1, owner hash 1315a5c6e8.

The first live attempt exposed Cloud Run IAM propagation longer than the
original retry horizon. The final run exercised a newly-created private
service and workflow from cold state:

• v1: SUCCEEDED, 114,236 ms, 37.40 dB PSNR
• v2: SUCCEEDED, 12,059 ms, 37.40 dB PSNR
• both outputs: 55,187 bytes, encoded SHA-256
  fe3bf65710fd0a362901dbecdfc50f22f5c4d974cbf7723365ad133cb65c929d
• decoded video frames: identical
• decoded audio: identical (NO_AUDIO fixture)
• normalized ffprobe metadata: identical
• frame manifest SHA-256 for both:
  ac64dc35c1cfb59e7c8aaddad900e15d406d9e9ae465a437e45c09a99fe4dedf

Automatic cleanup passed for the successful run. A separate read-only audit
checked Cloud Run, Workflows, both service accounts, render/build buckets,
Artifact Registry repositories, and image packages for the successful and
earlier failed owner hashes (1315a5c6e8, ac116fa597, 4926f2dcc6,
590d3dd8f2): 32/32 resources were absent.

Evidence is retained locally under
examples/gcp-cloud-run/scripts/gcp-smoke-artifacts/1315a5c6e8/; GCP retains
only Cloud Build and Cloud Logging/audit history.

[jrusso1020]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• refactor(producer): add plan v2 artifact publisher #2792
• feat(gcp-cloud-run): support plan protocol v2 #2790 👈 (View in Graphite)
• feat(aws-lambda): support plan protocol v2 #2789
• feat(producer): add content-addressed plan v2 #2788
• feat(producer): version distributed plan protocol #2777
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.