fix(terraform): isolate runtime-owned production drift

[jjcc123312]

Problem / evidence

Refreshing production plans remained unsafe after the certificate recovery because provider normalization and CI/CD-owned Cloud Run fields appeared as infrastructure updates. A full apply would have created Cloud Run revisions and rewritten an already-correct HTTPS proxy representation while also bundling unrelated Monitoring work.

Observed drift included:

• Cloud Run container-name/default-value normalization
• router sidecar startup CPU boost and volume ordering
• staging website probes changed by the deploy workflow
• Certificate Manager map URL versus project-resource-name normalization, plus legacy sslCertificates retained by the Compute API
• a broad Monitoring Editor role for the GitHub deployer even though production Terraform is local-only

Scope / design

• Align stable Cloud Run declarative values with the live provider representation where safe.
• Ignore staging probe fields owned by the staging deployment workflow.
• Ignore HTTPS proxy certificate representation fields; certificate cutovers remain explicit gcloud operations followed by verification.
• Remove the unnecessary roles/monitoring.editor grant from the GitHub deployer desired state.

Impact and risks

This PR changes ownership/lifecycle boundaries only. It does not deploy Cloud Run, alter revisions/traffic/env, change certificates or DNS, update Cloud SQL/secrets, or apply Monitoring policies. Production is multi-node; no runtime node is touched.

Validation

• terraform fmt
• terraform validate
• Fresh local Owner-ADC production plan reduces from 17 updates + 2 creates to Monitoring-only: 13 in-place alert-policy updates + 1 notification-channel create
• 0 destroy, no replacement, no Cloud Run/Cloud SQL/Secret/HTTPS proxy/IAM changes

Deployment recommendation

• Router deploy: not required
• Other deploy targets: Terraform desired-state only; Monitoring will be applied separately after merge with a saved plan
• Risk / validation: regenerate a fresh local plan from merged main and verify only Monitoring resources remain before apply