[minor] Add compiled GCP smoke cleanup runner

[libops-agent]

Summary

• replace privileged GCP Bash cleanup policy with a compiled Go runner
• parse structured gcloud output and enforce exact ownership, retries, deadlines, and residual verification
• retain legacy and exact GCP namespace readers while rejecting malformed run IDs before any gcloud call
• keep shell as a thin environment/invocation boundary; never use go run with cloud credentials

DigitalOcean and Linode cleanup remain trusted default-branch shell in this PR; their migration to typed provider HTTP cleanup is a separate follow-up.

Dependency

• Depends on [major] Harden the modular cloud runtime foundation #20 and must not merge before [major] Harden the modular cloud runtime foundation #20 and its PPB release dependency are complete.
• This PR targets main so hosted PR workflows run; refresh it after [major] Harden the modular cloud runtime foundation #20 merges before making it ready.

Validation

• go test -race -count=1 ./...
• go vet ./...
• portability, cleanup, upgrade, template-version, and rollout contracts
• terraform fmt, bash syntax, actionlint, git diff checks