Enforce the Cloud Run minimum-instance floor

[tsavo-at-pieces]

Summary

• enforce a configured Cloud Run service-level minimum of 1 on every deployment
• ensure each newly deployed revision clears any revision-level minimum
• fail the build if the service floor drifts or any traffic-referenced/tagged revision has a revision minimum
• document the distinction between the service floor and immutable dormant historical revisions

Live state corrected before this PR

Both services in global-cloud-runtime/us-central1 were updated and verified on 2026-08-04:

Environment	Service	Current revision	Service minimum	Current revision minimum
Staging	auth-hosting-staging	auth-hosting-staging-00013-j8t	1	absent
Production	auth-hosting	auth-hosting-00018-7l5	1	absent

Historical production revisions with immutable minScale=3 remain dormant, untagged, and receive no traffic. The new assertion prevents them from being reintroduced into a traffic split without failing deployment.

Verification

• cloudbuild.yaml parses as YAML
• the post-deploy Bash script parses after Cloud Build substitution simulation
• the assertion was run read-only against both live services and passed
• git diff --check passes
• an independent review validated Cloud Build escaping, gcloud flags, traffic-list parsing, and floor semantics

Existing repository baseline

This PR does not touch the application runtime. During audit:

• the direct rewired production build compiled, with a pre-existing missing-SHA version-file warning
• yarn lint:ci fails because the ESLint parser project excludes two checked files
• the existing test suite has 17 failures/2 passes caused by stale location/event mocks relative to the Pieces fork
• npm ci cannot use the stale lockfile; yarn is the repository's working installer

Those baseline repairs and the BYOS modernization are tracked in pieces-descope-byos-auth #30.