feat(gcp): add --compute cloudrun bootstrap mode

[naxty]

Summary

Adds a compute-substrate axis to the GCP bootstrap, orthogonal to --access:
--compute vm (default, unchanged) or --compute cloudrun. Cloud Run runs the agent as a
single always-on serverless service reached over the same external HTTPS LB as
--access public (via a serverless NEG), no VM/disk/startup-script.

Stacks on the BYO-cert work (feat/gcp-bootstrap-public-access) — base is that branch.

Draft: depends on the GCP plugin release carrying
formae-plugin-gcp#87
(template.vpcAccess, secret-volume items, Resolvable secret name). The gcp@ pin in
gcp/PklProject stays at 0.1.9 (vm modes unaffected); bump it to the #87 release to
enable --compute cloudrun. Undraft once that's published + pinned.

What it renders (--compute cloudrun)

Shared substrate (VPC/subnet/NAT/PSA, private Cloud SQL + formae db, db/api secrets, agent
SA + IAM) + a config-secret (whole agent config rendered by Pkl, mounted as a volume)
+ a Cloud Run Service (min=max=1, cpuIdle=false, port 49684, Direct VPC egress
PRIVATE_RANGES_ONLY, Cloud SQL connector volume, ingress=INTERNAL_LOAD_BALANCER) + a
serverless NEG + the reused LB chain (global address, backend service with no health
check, url map, HTTPS proxy, forwarding rule) + cert (SELF_MANAGED/MANAGED/by-name).

Verification (render matrix)

Against the local #87 schema:

• vm cells ({tailnet,public} × cert paths): byte-identical to pre-change formae eval (zero regression).
• cloudrun cells (domain / cert-file / cert-name): render the expected set; service asserts min=max=1, ingress lock, vpcAccess.egress, and a no-health-check backend service.
• validation throws: bad --compute; cloudrun+tailnet; cloudrun+ts-authkey; cloudrun with no cert.

Not included

Live E2E (real project + domain + cert + creds) — the manual gate; pending the plugin release.

[naxty]

Live E2E validation (2026-07-22/23)

Ran --compute cloudrun --access public against a real project (development-477117) + domain (formae.naxty.dev, self-signed cert). Summary: the architecture is validated end-to-end up to an org-policy wall; five real bugs were found and fixed (all in this PR + plugin #87).

Validated ✅

• Cloud Run revision goes READY (repeatedly): config-as-secret mounted, agent read it, connected to the private Cloud SQL over Direct VPC egress + the built-in connector unix socket, ran migrations, bound :49684. The novel/load-bearing parts work.
• Ingress lock confirmed: hitting the *.run.app URL directly → 403 (only the LB is allowed in).
• LB chain reaches Cloud Run via the serverless NEG.

Blocked (environmental, not code) ⛔

• The external HTTPS LB forwards to Cloud Run unauthenticated, so the service needs allUsers → roles/run.invoker. Granting it fails on this project with FAILED_PRECONDITION: ... not a permitted customer — org policy constraints/iam.allowedPolicyMemberDomains (domain-restricted sharing) forbids allUsers. So the final basic-auth-200-through-LB can't be demonstrated here without an org-policy exception or IAP. --compute cloudrun --access public cannot work in a domain-restricted org without one of those (documented in gcp/README.md).

Bugs found live → fixed

#	Bug	Fix
1	vpcAccess.network/subnetwork rejected the selfLink URL	plugin normalizes selfLink→relative path (#87)
2	Cloud SQL socket DSN: connectionParams appended as ?sslmode=disable onto the DB name → database "formae?sslmode=disable" does not exist	drop connectionParams for the socket path (this PR)
3	Cloud Run service create hung ~50min (min-instances keeps a failing revision warming → LRO never completes)	Status succeeds once the service object exists (#87)
4	create-order race (service created before subnet on a fresh apply)	resolvable net/subnet ref for the edge + plugin selfLink normalization (#87 + this PR)
5	Cloud Run 403s all LB traffic — no run.invoker	add allUsers/run.invoker GCP::CloudRun::ServiceIamMember (this PR)

Follow-up (separate, not this feature)

• formae's serverless-NEG create fails silently in-command (no error on the resource or in the agent log) while gcloud creates the identical NEG fine; because the command then fails, formae doesn't persist the already-successful service → next reconcile 409s on it. This is why the manual-gcloud LB was used to prove the path. Needs a formae-agent look at the compute serverless-NEG create/operation path.

Render matrix (against the #87 schema) stays green: 4 vm cells byte-identical to pre-change, 3 cloudrun cert cells render the full set, 4 validation throws. Unit tests pass.