Triage: Add a GCP GKE Agent Sandbox runtime adapter

[time-attack]

Tracking the change proposed in #367 (by @ssalih1993).

We're moving this from a code PR to a tracked issue under CONTRIBUTING.md: feature ideas belong in adrs/ as a short human-written note and bugs as an issue, and we implement the underlying code from our side. Capturing the original proposal here so it isn't lost.

Original PR: #367
Reported by: @ssalih1993

---

Summary

Add a provider-native GCP runtime path for QM:

• provision isolated agent computers through GKE Agent Sandbox SandboxClaim resources
• route the existing agent-daemon protocol through the in-cluster sandbox router
• store durable file bytes and transfer blobs in Cloud Storage
• allow hosted-app deployment to fail closed when no deploy provider is configured
• document the Workload Identity, namespace RBAC, runtime variables, and operator-owned infrastructure boundary

The adapter does not create GKE, Cloud SQL, buckets, IAM, or Secret Manager resources.

Verification

• 37 focused config/GKE/GCS/disabled-provider tests passed
• TypeScript typecheck passed
• ESLint passed on the changed TypeScript files
• diff check passed
• independent review of the GKE control path passed

Live validation

The adapter has been exercised against a GKE Agent Sandbox warm pool. The final compatibility fix uses the request-object API required by @kubernetes/client-node 1.4 for custom resource create/get/delete calls.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

If we ship a fix or feature from this, credit @ssalih1993 as co-author.