Switch deploy target to GCP Cloud Run gen2

AWS Lambda cannot run shimmy's nsjail sandbox: locked seccomp profile,
no CAP_SYS_ADMIN, no privileged mode, so SANDBOX_ENABLED=true makes the
worker fail to start (verified on staging -- every request 500s with a
broken-pipe from the dead worker). Cloud Run gen2 gives full-Linux
compatibility, so nsjail can create the user namespace it needs.

Set build-platforms: "gcp" for both staging and production. The shared
gcp_deploy.yml deploys with --execution-environment gen2 (its new
default).

Follow-ups before this is live: merge + push the workflows-repo change;
set S3_BUCKET_URI and AWS_* on the Cloud Run service (no execution role
to inject them); repoint the platform at the *.run.app URL; re-probe
nsjail on the deployed gen2 service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RYbUtnGroazAj1fNjXQmV7

Author: m-messer

.github/workflows/production-deploy.yml

@@ -41,6 +41,10 @@ jobs:
     uses: lambda-feedback/evaluation-function-workflows/.github/workflows/deploy.yml@main
     with:
       template-repository-name: 'lambda-feedback/evaluation-function-boilerplate-python'
+      # gcp -> Cloud Run gen2 (see gcp_deploy.yml). gen2 gives full-Linux
+      # compatibility so shimmy's nsjail sandbox (SANDBOX_ENABLED=true in the
+      # Dockerfile) can create user namespaces -- AWS Lambda cannot.
+      build-platforms: "gcp"
       environment: "production"
       version-bump: ${{ inputs.version-bump }}
       branch: ${{ inputs.branch }}

.github/workflows/staging-deploy.yml

@@ -59,7 +59,10 @@ jobs:
     uses: lambda-feedback/evaluation-function-workflows/.github/workflows/deploy.yml@main
     with:
       template-repository-name: "lambda-feedback/evaluation-function-boilerplate-python"
-      build-platforms: "aws"
+      # gcp -> Cloud Run gen2 (see gcp_deploy.yml). gen2 gives full-Linux
+      # compatibility so shimmy's nsjail sandbox (SANDBOX_ENABLED=true in the
+      # Dockerfile) can create user namespaces -- AWS Lambda cannot.
+      build-platforms: "gcp"
       environment: "staging"
       lfs: false
     secrets: