Create a private project with a retry ID and a short label.

Private and no-store. No catalog quota, paid read, public cache or CORS grant. Use the same ID on retry. A replay keeps the original name and performs no new domain write. Labels must not contain local paths, control characters or secrets. Returns: { id }