Verify API contracts and live deployment identity

[lgoyal6]

Tollgate's strengthening branch now turns three plan claims into executable evidence: the admin API is exercised through its OpenAPI contract, Cloud Run canaries are probed with the active deployment identity, and the deployment workflow verifies a real GitHub-issued OIDC identity against bounded GCP permissions.

Live identity lifecycle evidence:

• original Workload Identity provider succeeded in run 34101929938
• rotated provider succeeded in run 34102089010
• disabling the original provider caused run 34102274391 to fail at the STS exchange
• reusable final workflow succeeded in run 34102806086
• GitHub OIDC token lifetime was 300 seconds and the exchanged GCP access token lifetime was 883 seconds
• the identity could push to its assigned Artifact Registry repository, but could not access a neighboring repository or runtime secrets
• tracked-file and workflow-log credential scans passed
• all 18 temporary GCP identity resources were destroyed after verification

Argus also completed the companion bounded Cloud Run rollout: 10% canary traffic, authenticated probe, seeded failure, rollback to 100% baseline, Ready=True, and maxScale=1.

Validation:

• full Go suite passed
• Helm lint passed
• Schemathesis covered 9/9 operations, 2,825/2,825 fuzz cases, 195/195 scenarios, and 1,518/1,518 stateful cases
• git diff --check passes