Execute a launch asynchronously. Called by Cloud Tasks, not by users.

This endpoint receives a callback from Google Cloud Tasks after create_launch dispatches the work. It loads the launch from Firestore and runs the orchestrator, which may take several minutes (e.g. Instagram video processing).

Authentication: verified Google OIDC only (require_cron_oidc, SEC-07) — the same guard as process_scheduled_launches below and every other Cloud Tasks target.

This docstring previously claimed the Cloud Tasks header X-CloudTasks-QueueName was checked "to prevent direct invocation from external clients". No such check existed anywhere in the function: the route executed a launch — publishing to creators' connected social accounts — for anything that could reach the URL. A header would not have been worth much either, since any caller can send one; that is why SEC-07 replaced presence-of-header authorisation across the cron routes.

When platform_config_id is provided, only that single platform executes (per-platform schedules, Phase 4 Option B). The parent launch finalises only once every platform has reached a terminal state, so multiple per-platform tasks can fire independently.