Add GCP broker v1

[kovyrin]

Summary

• adds the GCP broker planning doc and v1 exec/session/auth implementation
• adds daemon-owned Google OAuth bootstrap support with Keychain-backed refresh state and IAMCredentials token minting
• covers GCP auth/session/CLI paths with focused tests and keeps the local lint/test/build gate green

Verification

• mise run lint
• mise run test
• mise run build

Notes

• Live GCP OAuth smoke is still blocked on completing a browser OAuth flow or supplying the fixture OAuth client secret. The integration fixture is documented, and local non-secret gates are green.