fix(gcp): support scalable preconfigured custom-image hosts

[Brad-Edwards]

Summary

Allow an administrator-pinned exact GCE custom image to realize a preconfigured participant host without coupling Compute source type to guest readiness.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #2382

ADR Impact

• ADR-031
• ADR-037
• ADR-039

Changes

• Validate exact custom-image host profiles across registry, operation input, and adapter bindings while retaining machine-image compatibility.
• Create one owned boot disk with nested virtualization and existing security controls; reject conflicting VM adoption and clean attempt-created resources on a late conflict.
• Run bounded participant readiness on fresh and warm RAES paths, converge disk auto-delete on reconcile and teardown, and expose the source/capability choice in admin forms.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

Provisioner suite: 2,184 passed, 7 skipped; focused portal service and wire tests: 139 passed; frontend tests: 17 passed; frontend lint/typecheck, Python Ruff/import-linter, and ADR guard passed.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: (none — bug/refactor/maintenance run)
• TESTS: (none — documentation/configuration/structural-invariant run)

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud