Probe Gcp Fulfillment Reader

Prove the GCS reads actually work -- issue #2608, unit 8. Same "save then verify" shape as /api/system/google_gemini/probe, adapted for a credential that mints its own bearer token rather than carrying one directly: mints a JWT-bearer token (proving the Workspace key is well-formed and Google accepts the assertion) and, when at least one bucket is on the allowlist, also reads THAT bucket's own metadata (proving the IAM grant too).

⛔BUCKET METADATA ONLY, NEVER AN OBJECT READ (unit 8's own rule) -- see gcs_reader.probe_credential's own docstring.

⛔CORRECTED 2026-09-30: this used to also record the verdict against a separate gcp_fulfillment_reader vault row (service. record_credential_probe_result). That row no longer exists -- the credential probed here is the reused Workspace service account, which is never pasted through this page -- so there is nothing left to record a probe result against; the verdict is returned to the card directly and nowhere else, same as before this correction from the caller's point of view.