Add non-trading Cloud Run warmup scheduler

[Pigbibi]

Summary

• create/update an authenticated Cloud Scheduler warmup job per Cloud Run service
• call GET /healthz at the configured probe_time
• retry only the non-trading warmup request (2 retries, bounded backoff)
• leave the live /run scheduler retry policy unchanged

Incident addressed

Two active US services returned HTTP 500 while Cloud Run was starting a new instance. No strategy execution report or order submission was observed. The warmup moves cold-start work before the trading scheduler without making live execution retryable.

Validation

• uv run pytest -q tests/test_cloud_run_warmup_workflow.py tests/test_cloud_run_runtime_guard.py tests/test_reconcile_cloud_runtime.py — 17 passed
• uv run ruff check . — passed
• actionlint .github/workflows/sync-cloud-run-env.yml — passed
• Ruby YAML parse — passed
• git diff --check — passed

Full uv run pytest -q: 309 passed, 5 skipped, 11 pre-existing failures in unrelated runtime/test-drift areas. This PR changes only the env-sync workflow and its static contract test.

Safety boundary

• no manual /run
• no live execution retry
• no Cloud Run or Scheduler deployment in this PR itself

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: No issues found

---

Review by Codex PR Review bot • PR