[codex] Add GCP CI runner setup

[stefandeml]

Summary

Add GCP runner provisioning and bootstrap scripts for the Delta CI runner rollout.

This covers both runner classes:

• standalone runners for .github/workflows/standalone-tests.yml
• integration runners with nested virtualization for integration workflows

Linked Delta workflow PR: https://github.com/decentriq/delta/pull/5100

What changed

• Add gcloud/create-vm.sh for persistent standalone runner VMs.
• Add gcloud/create-integration-vm.sh for nested-virtualization-capable integration runner VMs.
• Add gcloud/setup-runner.sh to install Docker, daemon-mode Nix, Ops Agent, a pinned GitHub Actions runner, ssh-agent-setup, and GC timers.
• Add gcloud/setup-integration-runner.sh as the nested-virt integration wrapper.
• Add gcloud/start-runner.sh for service repair/startup.
• Document the rollout flow and final workflow labels in gcloud/README.md.

Runner routing

Standalone runners are labeled:

gcp,gcp-standalone,<runner-name>,standalone-tests,build,live

Integration runners are labeled:

gcp-integration,gcp-integration-runner-1,integration-tests,runner,build,live

Standalone runners intentionally do not receive runner or integration-tests, so nested-virt jobs cannot land on them.

Validation

• bash -n gcloud/create-vm.sh
• bash -n gcloud/create-integration-vm.sh
• bash -n gcloud/setup-runner.sh
• bash -n gcloud/setup-integration-runner.sh
• bash -n gcloud/start-runner.sh

Operational validation already performed:

• gcp-integration-runner-1 completed integration-test.yml successfully on GCP with nested virtualization in use.
• gcp-standalone-runner-1/2/3 were created as c3d-highmem-4 VMs and registered successfully.
• Ops Agent and GitHub runner systemd services were verified active on all three standalone runners.

Notes

• The integration default remains the proven c3-highmem-44. The handoff notes that c3-highmem-22 was resized for follow-up validation, but that size is not made the default here.
• GitHub runner registration tokens are prompted interactively and are not passed as command-line arguments or stored in files.