feat: add docker-build and cloudrun-deploy composite actions

[gamechanger1s]

Summary

The existing `build@v2` and `deploy@v2` composite actions are designed around a static-site deployment pattern — they produce a file artifact, upload it between jobs, and push it to a GCS bucket + CDN. They cannot be reused as-is for projects that build a Docker image and deploy to a container runtime.

Rather than adding standalone actions, this PR extends the existing `build@v2` and `deploy@v2` actions with conditional Docker/Cloud Run paths via new opt-in inputs. Existing callers are completely unaffected — all new inputs default to empty and every new step is gated behind its discriminator.

---

`build@v2` — Docker path (activated by `image-name`)

When `image-name` is set the action switches to Docker build+push mode. The static-build steps (`Build`, `Upload artifact`) are skipped via `if: inputs.image-name == ''`. New steps run in their place:

• Configures the Docker credential helper for Artifact Registry (`gcloud auth configure-docker`)
• Optionally fetches build-time env vars from Secret Manager → writes to `.env.production` so framework-level public vars are baked into the client bundle before the image is assembled
• Sets up Docker Buildx
• Builds and pushes directly to Artifact Registry (SHA tag + `latest`) in a single step — no inter-job image cache needed

`deploy@v2` — Cloud Run path (activated by `cloudrun-service`)

When `cloudrun-service` is set the action switches to Cloud Run deploy mode. The standard `Deploy` step is skipped via `if: inputs.cloudrun-service == ''`. New steps run in their place:

• Optionally fetches runtime env vars from Secret Manager, masks each value, formats them as `KEY=VALUE,...` and prepends `GOOGLE_CLOUD_PROJECT`
• Deploys the image to Cloud Run via `deploy-cloudrun@v2` with the `overwrite` env var strategy

---

Design decisions

• Single discriminator per action — `image-name` for build, `cloudrun-service` for deploy. Non-empty = new path, empty = existing path. No ambiguous mode flags.
• Shared auth step — the existing `Authenticate` step is unchanged and runs for both paths whenever GCP/AWS credentials are provided.
• `Summary` step handles both paths — emits image info on Docker path, env+output on static path.
• Standalone actions removed — `docker-build` and `cloudrun-deploy` introduced in the first commit of this branch have been removed in favour of this approach.

Test plan

• Existing caller (`frontend-web` using `build@v2` with `node-version` + `output: artifact`) continues to work unchanged
• New Docker caller passes `image-name` → Docker path runs, static steps are skipped
• `build@v2` correctly writes `.env.production` when `gcp-secret-name` is provided, skips when empty
• New Cloud Run caller passes `cloudrun-service` → Cloud Run path runs, standard deploy step is skipped
• `deploy@v2` injects env vars correctly when `gcp-secret-name` is provided, deploys cleanly when empty
• Merge and move the `v2` tag to this commit

🤖 Generated with Claude Code