Harden Cloud Run deployment safety

[Pigbibi]

Summary

• fail closed when Cloud Run deploy configuration is absent
• require approved ref and immutable commit SHA
• deploy a no-traffic revision by default
• require explicit opt-in for configuration sync, traffic promotion, and cleanup
• verify non-secret deployment readback before any promotion

Validation

• actionlint
• static workflow tests
• git diff --check

No workflow, deployment, runtime endpoint, gateway, or broker call was triggered.