docs(runtime): stage isolated Binance shadow migration

[Pigbibi]

Summary

• document the current persistent-runner boundary and prefer an isolated Cloud Run Job over operating an ephemeral runner control plane
• define least-privilege identities, static-egress, no-retry/idempotency, preflight, staged canary, and rollback requirements
• add a manual GitHub-hosted fixed-input shadow workflow with no OIDC, environment, or secrets
• fail the shadow proof unless dry_run=true, executed_call_count=0, and suppressed side effects are present

Safety boundary

This PR does not modify .github/workflows/main.yml, switch the current live path, create GCP resources, move broker secrets, delete the old runner, or change broker permissions.

Validation

• .venv/bin/python -m pytest -q tests/test_runtime_isolation_shadow.py tests/test_cycle_replay_runtime.py tests/test_runtime_workflow_security.py (10 passed)
• fixed-input replay plus scripts/assert_no_order_shadow_report.py (dry_run=true, zero executed calls)
• ruff check scripts/assert_no_order_shadow_report.py tests/test_runtime_isolation_shadow.py
• git diff --check