Add hosted execution worker

[jeremydixon22]

Summary

• add a consumer-neutral, deployable Vyral worker for hosted generic execution handlers, initially vyral.artifacts.record-ingest
• preserve the portable execution contract across API admission, provider dispatch, worker leases, heartbeats, terminal completion, retries, and replay
• authenticate Cloud Tasks callbacks with Google OIDC and keep API, worker, dispatch, and qualification caller identities distinct
• share Vyral-owned storage/ingestion behavior between the API and worker, with Cloud Run configuration and least-privilege preflight guidance
• correct invalid Google token handling, camelCase dispatch deserialization, and provider-generated staging ETags affecting idempotency

Validation

• dotnet build Vyral.sln --no-restore — 0 warnings, 0 errors
• dotnet test Vyral.sln --no-build --no-restore — 663 passed, 211 skipped, 0 failed
• scripts/verify-pr-release-boundary.sh --allow-dirty
• live private Cloud Run qualification: durable admission reached succeeded on attempt 1; replay returned the original run; duplicate delivery was a no-op; staging and queue drained; final revisions had no error logs

The live receipt remains ignored and local because it describes the pre-commit candidate. Canonical qualification evidence can be regenerated from a committed revision after review.