feat(cloud): make the gcloud-robot identity the obviously correct path (kata e83z)

[danshapiro]

What this changes

Agent-launched cloud test lanes (scripts/vitest-cloud.sh, scripts/e2e-cloud.sh) now resolve the provisioned gcloud-robot identity by default instead of silently falling through to a possibly-stale ambient identity, and fail fast on identity problems instead of hanging on gcloud's interactive reauth prompt.

• Well-known-install discovery (scripts/lib/gcp-identity.sh): when GCLOUD_ROBOT_HOME is unset, the bridge probes ~/.codex/skills/gcloud-robot, ~/.claude/skills/gcloud-robot, and ~/code/skill-gcloud-robot/gcloud-robot (validating scripts/select-gcloud-identity.sh is present and executable) before falling to ambient gcloud. No match: existing one-line note, unchanged behavior. The skill-owned selector and the verbatim drop-in block are untouched.
• Fail-fast identity (both wrappers): CLOUDSDK_CORE_DISABLE_PROMPTS=1 is exported only when stdin is not a TTY ([ ! -t 0 ]), so non-interactive shells get immediate errors while human terminals keep interactive reauth; a cheap gcloud auth print-access-token preflight runs after every identity resolve in both wrappers, so a dead credential surfaces in seconds — before any build/submit work.
• Observability: run and build lanes print the resolved identity and its ladder rung (stdout, leading the lane output, before the image-lookup/rebuild decision) and a loud WARNING when a -dirty image tag is taken (not content-addressed, not reusable).
• Docs: AGENTS.md recommends GCLOUD_ROBOT_REQUIRE=1 as the default for agent-launched broad gates; ladder wording updated in both Identity paragraphs, the runbook, and both wrappers' usage() text.

Tests

• scripts/test/cloud-gcp-identity.test.sh extended to 86 checks (discovery order/validation, no-match byte-identity, strict mode, preflight ordering, banner attribution, TTY-gated prompt env, help-text contracts).
• cloud-vitest-wrapper.test.sh (43 checks) and cloud-build.test.sh (31 checks): non-TTY prompt suppression, preflight-before-build-work ordering, failed-preflight exit-fast, dirty WARNING ordering on run and build lanes.
• All 14 bash cloud/e2e-harness suites green at the final commit.
• Full coordinated suite green at the final commit (client via Cloud Run vitest, Rust, electron local), plus live smokes: resolve-level discovery smoke and a real narrowed cloud lane run under the robot identity (banner-verified).

Harness repairs included (pre-existing reds, no assertions weakened)

• cloud-exec-id-parse.test.sh: fake gcloud gained the missing logging read stub the e2e wrapper's receipts reconciliation requires.
• cloud-run-dockerfile.test.sh: dropped the CLI --reporter=line flag that replaced the config's reporter array (retry report is now written) and completed the Cloud Run task emulation with CLOUD_RUN_EXECUTION, matching the receipts-suite idiom.
• cloud-vitest-integration.test.sh: restored byte-faithful to base minus the obsolete port-contract prose-grep (its target string was removed when the Node server was retired); its runtime-surfaces manifest row restored.