Harden Cloud Run deployment safety

[Pigbibi]

Summary

• require approved ref and immutable commit SHA
• make image deployment no-traffic by default
• require explicit opt-in for configuration sync, scheduler/IAM mutation, traffic promotion, and cleanup
• verify non-secret deployment readback before any promotion

Validation

• actionlint
• static workflow safety test
• git diff --check

No workflow, deployment, runtime endpoint, gateway, or broker call was triggered.