feat: gate Cloud Run rollouts on target admission

[Pigbibi]

Summary

• verify each deployed Cloud Run runtime target before an image rollout
• fail closed for retired profiles, target/profile drift, and Paper/Shadow/Live semantic drift
• ensure disabled deployment automation cannot build or deploy
• preserve previous images and revisions unless cleanup is explicitly enabled

Safety

The verifier reads only non-sensitive Cloud Run identity configuration and makes no mutations. It never remaps a retired strategy.

Verification

• uv run --extra test python -m pytest -q tests/test_deployed_runtime_target_admission.py
• uv run --extra test python -m pytest -q tests/test_runtime_config_support.py -k build_cloud_run_env_sync_plan
• uv run --extra test ruff check scripts/verify_deployed_runtime_target_admission.py tests/test_deployed_runtime_target_admission.py
• live read-only check: retired shadow target failed closed as expected