[patch] Gate cloud smoke cleanup through trusted workflow

[libops-agent]

Summary

• move destructive fallback cleanup into a trusted workflow with explicit inputs and permissions
• inventory resources created by hosted GCP smoke and clean them in dependency-safe order
• make normal smoke cleanup bounded, observable, and resilient to partial Terraform failure
• keep forked/untrusted pull requests from receiving cleanup credentials
• document the hosted smoke cleanup contract

Validation

• cleanup and cloud-smoke shell contracts
• shell syntax and Terraform/static checks
• GitHub-hosted PR checks are required before merge

No local cloud smoke was run. This patch release lands before the larger cloud-compose module update.