fix(gcp): honor admin-selected public web egress for runtime target images

[Brad-Edwards]

Summary

• Carry a default-off public-web option through the administrator-selected runtime target image profile, API, and pack-assignment UI.
• Preserve that option in the pinned GCE realization profile so the existing range-cell planner emits its scoped TCP 80/443 public-web rule for new ranges.
• Reject the GCP-only option on AWS target profiles; existing range bindings remain unchanged.
• Verify retained adapter pins against their exact stored payload before interpreting newly defaulted fields, so older ranges remain eligible for cleanup without weakening tamper detection.
• Sweep the optional web-egress firewall by its deterministic range name during reconstructive teardown, including failed provisions.

ADR Impact

• No ADR impact; this uses the existing profile-controlled public-web policy.

Guardrail Changes

• No guardrail files changed.

Verification

• ADR guard CI level and import-linter passed.
• Focused CMS, runtime-binding, GCE image/plan, and frontend tests passed; frontend typecheck and Ruff passed.
• Legacy retained-pin cleanup and tamper-rejection regression test passed.
• Reconstructive teardown sweep regression passed with 186 focused GCE tests.
• OpenAPI and TypeScript contracts regenerated; deployment documentation updated.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
92.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud