feat(runtime): add deployment-neutral isolation discovery

[Pigbibi]

Summary

• replace the unverified Cloud Run-first assumption with a deployment-neutral Phase 2 decision gate
• document evidence and a decision matrix for same-host ephemeral, disposable VPS/VM, and Cloud Run Job candidates
• add a secret-free host profile workflow that records host-provider evidence and optionally verifies egress without publishing the raw address or digest
• add a portable no-order fixture runner and semantic report digest comparison between GitHub-hosted and the current self-hosted runner
• keep Cloud Run-specific controls conditional: digest-pinned image, dedicated runtime/invoker identities, tasks=1, parallelism=1, maxRetries=0

Safety boundary

• creates no GCP, VM, runner, IAM, network, registry, or secret resources
• reads or writes no broker secret
• does not change the current live workflow, scheduler, broker permissions, or cutover authority
• unknown host/provider/egress evidence remains PARTIAL/UNVERIFIED

Evidence

• local no-order fixture: status=ok, dry_run=true, executed_call_count=0, suppressed_call_count=11
• semantic digest: c52a7cf15079ef3346b6f45bbd3b48aef59c539e868e7780ea9f535e17fee1ed
• 9 targeted isolation tests passed
• ruff passed
• actionlint v1.7.12 passed for both changed workflows
• git diff --check passed

The broad local suite still has three unrelated cross-repository profile failures because the workspace sibling QuantPlatformKit/CryptoStrategies checkouts do not match this repository pinned revisions. GitHub CI installs the pinned revisions and is the authoritative full-suite result.

Official design references

• https://docs.github.com/en/actions/reference/runners/self-hosted-runners
• https://docs.github.com/en/actions/reference/security/secure-use
• https://cloud.google.com/run/docs/create-jobs
• https://cloud.google.com/run/docs/configuring/static-outbound-ip
• https://cloud.google.com/iam/docs/workload-identity-federation-with-deployment-pipelines