Add protected read-only account data readiness diagnostic

[Pigbibi]

Scope

Add an opt-in metadata-only branch to the existing lifecycle workflow so account data readiness can be checked with its existing protected service selection and WIF identity.

Changes

• Keep the scheduled and default lifecycle paths unchanged.
• Read only the configured Cloud Run service, its actual single serving revision, then the service again to reject concurrent changes.
• Return only fixed classifications, public source commit, and selector configuration presence/source. No account values, resource names, secret contents, broker calls, notifications, or control-plane publication.
• Enforce fixed Google REST GET destinations, no redirects/retries, and bounded responses.

Validation

• 27 focused synthetic tests passed.
• Ruff, actionlint, Python compile check and diff check passed.
• Independent review passed against the Cloud Run v2 API shapes.

Actual cloud metadata, account identity validity, and balance qualification require separate verification after adoption. This change does not activate trading or modify production runtime settings.