Add support for Cloud Run Worker Pool Containers

[rkeene]

This change adds support for Cloud Run Worker Pool Containers, which are similar to the ContainerMIG we already provide but utilize Cloud Run Worker Pools (which recently became Generally Available).

---

Note

Medium Risk
Touches core GCP provisioning (VPC egress/NAT, IAM, worker topology) and removes CloudRunService stack outputs, which may break downstream Pulumi consumers.

Overview
Adds Cloud Run Worker Pools as an alternative to MIG-based background workers, selectable via mig.workerKind: 'crwp' on CloudRunService (default remains MIG).

Introduces ContainerCloudRun, which provisions a cloudrunv2.WorkerPool with shared IAM/registry setup extracted into handleGenericOptions. CRWP workers use Secret Manager env refs (cloudRunJobVariableOutput) instead of resolved plain env vars, and support egress modes (vpc, vpc+nat with optional Cloud NAT/router/route, vpc+direct). Incompatible MIG-only options (cosImage, enableSSH, allocateExternalIP) error when crwp is chosen.

ContainerMIG is refactored onto the shared options helper; registry IAM now targets Artifact Registry paths only (legacy artifacts.*.appspot.com bucket grant removed). EnvManager no longer emits a conflicting value field when env vars use secret refs.

Note: CloudRunService no longer calls registerOutputs for serviceUrl, backendService, mig, and migrationStatus at the end of its constructor.

^{Reviewed by Cursor Bugbot for commit eeb54f3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rkeene]

@cursor review

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 8656a5e. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud