[minor] Harden power proxy readiness and trust

[pennypacker-he]

Summary

• bound and coordinate GCE start/resume work with request cancellation and transition reconciliation
• add connection-establishment retries for VM boot and Direct VPC cold readiness without replaying application requests
• fail closed on malformed or undersized trusted-proxy chains and replace forwarding identity with the validated client
• validate deployment configuration and expose explicit power/dial timeout controls
• pin release/build dependencies and add security-focused tests for TLS, proxying, IP authorization, and machine control
• document whole-subnet Direct VPC firewalling, Cloud Run timeout sizing, and least-privilege instance IAM

Validation

• Go unit and race tests
• static analysis and release configuration checks
• GitHub-hosted multi-architecture builds are required before merge

No local cloud or application smoke was run; hosted CI is the publication gate.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 71.33758% with 90 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/proxy/tls.go	73.17%	21 Missing and 12 partials ⚠️
pkg/machine/gce.go	72.07%	25 Missing and 6 partials ⚠️
main.go	60.60%	10 Missing and 3 partials ⚠️
pkg/config/ipAuth.go	70.96%	5 Missing and 4 partials ⚠️
pkg/config/config.go	75.00%	2 Missing and 2 partials ⚠️

Files with missing lines	Coverage Δ
pkg/config/config.go	80.28% <75.00%> (+5.28%)	⬆️
pkg/config/ipAuth.go	72.97% <70.96%> (-20.14%)	⬇️
main.go	50.00% <60.60%> (+15.11%)	⬆️
pkg/machine/gce.go	66.48% <72.07%> (+17.53%)	⬆️
pkg/proxy/tls.go	75.67% <73.17%> (+22.22%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.