Add GCP support

[artemnikitin]

Summary

Extends the CI image pipeline with GCP support and adds a pre-build config validation job.

Config validation (validate-config job)

A new validate-config job now runs before any image build. It checks out artemnikitin/firework at the ref pinned in repo variable FIREWORK_CONFIG_REF (falls back to commit be5c449 when the variable is unset, because cmd/configcheck is not yet on firework main). It runs go run ./cmd/configcheck --require-remote-routing against the repository root, so a misconfigured runtime YAML fails fast without spending build minutes.

GCS upload (upload-gcs job)

A new upload-gcs job runs on pushes to main, after build. It:

• Downloads the amd64 rootfs artifact produced by the build matrix
• Authenticates to GCP via Workload Identity Federation (keyless; no long-lived credentials)
• Uploads *-rootfs.ext4 to gs://$GCS_IMAGES_BUCKET/ via make push-gcs

ARM64 images continue to upload to S3 (make push-s3). The split keeps amd64 and ARM64 image basenames in separate buckets so they cannot overwrite each other.

push-images.sh dual-backend support

scripts/push-images.sh now checks GCS_IMAGES_BUCKET first, then S3_IMAGES_BUCKET. Exactly one must be set; the script exits non-zero if neither is provided.

Provider-neutral routing

Tenant files now set metadata.subdomain (one DNS label) instead of metadata.host (exact FQDN). The deployed agent's ingress_domain forms <subdomain>.<ingress_domain>. This removes the AWS-only hostname assumption and works identically on GCP.