fix(ctf): scale event egress without per-range routers

[Brad-Edwards]

Summary

CTF launches now pin the event workspace's egress policy without changing participant range ownership. Shared-VPC GCP ranges use serialized, explicitly scoped regional NAT capacity instead of a router per range.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #2372

ADR Impact

• ADR-017
• ADR-021
• ADR-026
• ADR-046
• ADR-056

Changes

• Carry and authorize the event policy workspace through participant, spare, recovery, and CMS reservation paths; reject incompatible spare reuse and warm claims.
• Allocate, reconcile, and remove explicit shared NAT subnet memberships under a regional lock, with bounded capacity and migration-bridge replay safety.
• Document capacity, policy/audit behavior, and migration ownership; align the binding ADR rules.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

Targeted platform and GCP suites, import boundaries, Ruff, and ADR guard passed locally; hosted CI remains the delivery gate.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: PLAT-238 ← shifter/engine/provisioner/gcp_range_cell_shared_nat.py
• TESTS: PLAT-238 ← shifter/engine/provisioner/tests/test_gcp_shared_nat.py

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

[Brad-Edwards]

Ground Control delivery — this pull request delivers issue #2372; Phase E runs on merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
94.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud