fix(terraform): isolate runtime-owned production drift

deploy/gcp/envs/prod/staging.tf

@@ -385,6 +385,8 @@ resource "google_cloud_run_v2_service" "staging" {
     ignore_changes = [
       template[0].containers[0].env,
       template[0].containers[0].image,
+      template[0].containers[0].liveness_probe,
+      template[0].containers[0].startup_probe,
       template[0].revision,
       client,
       client_version,
@@ -502,6 +504,8 @@ resource "google_cloud_run_v2_service" "staging_web" {
     ignore_changes = [
       template[0].containers[0].env,
       template[0].containers[0].image,
+      template[0].containers[0].liveness_probe,
+      template[0].containers[0].startup_probe,
       template[0].revision,
       client,
       client_version,

deploy/gcp/modules/cloud-lb/main.tf

@@ -361,6 +361,15 @@ resource "google_compute_target_https_proxy" "https" {
   // handshake on the ~185ms-RTT path to the LB; QUIC collapses it to 1-RTT (0-RTT
   // on resumption) and tolerates jitter on the China Telecom 163 egress better.
   quic_override = "ENABLE"
+
+  lifecycle {
+    // Compute returns the Certificate Manager map as a v1 URL while the
+    // provider normalizes configuration to a project resource name. It also
+    // keeps legacy sslCertificates visible after a certificate map is bound.
+    // Both are API representation artifacts; certificate cutovers are handled
+    // explicitly with gcloud and then verified before state reconciliation.
+    ignore_changes = [certificate_map, ssl_certificates]
+  }
 }
 
 resource "google_compute_global_forwarding_rule" "https" {

deploy/gcp/modules/cloud-run/main.tf

@@ -16,10 +16,7 @@ resource "google_cloud_run_v2_service" "main" {
   deletion_protection = var.deletion_protection
 
   template {
-    service_account = var.runtime_sa_email
-    annotations = var.prometheus_sidecar_enabled ? {
-      "run.googleapis.com/container-dependencies" = "{\"collector\":[\"app\"]}"
-    } : null
+    service_account       = var.runtime_sa_email
     execution_environment = var.prometheus_sidecar_enabled ? "EXECUTION_ENVIRONMENT_GEN2" : null
 
     scaling {
@@ -38,13 +35,6 @@ resource "google_cloud_run_v2_service" "main" {
       egress = "PRIVATE_RANGES_ONLY"
     }
 
-    volumes {
-      name = "cloudsql"
-      cloud_sql_instance {
-        instances = [var.cloudsql_connection_name]
-      }
-    }
-
     dynamic "volumes" {
       for_each = var.prometheus_sidecar_enabled ? [1] : []
       content {
@@ -59,8 +49,15 @@ resource "google_cloud_run_v2_service" "main" {
       }
     }
 
+    volumes {
+      name = "cloudsql"
+      cloud_sql_instance {
+        instances = [var.cloudsql_connection_name]
+      }
+    }
+
     containers {
-      name  = "app"
+      name  = var.prometheus_sidecar_enabled ? "app" : null
       image = var.image_uri
 
       resources {
@@ -260,7 +257,7 @@ resource "google_cloud_run_v2_service" "main" {
             memory = var.prometheus_sidecar_memory
           }
           cpu_idle          = false
-          startup_cpu_boost = false
+          startup_cpu_boost = true
         }
 
         volume_mounts {

deploy/gcp/modules/service-accounts/main.tf

@@ -62,12 +62,6 @@ resource "google_project_iam_member" "deployer_artifact_writer" {
   member  = "serviceAccount:${google_service_account.deployer.email}"
 }
 
-resource "google_project_iam_member" "deployer_monitoring_editor" {
-  project = var.project_id
-  role    = "roles/monitoring.editor"
-  member  = "serviceAccount:${google_service_account.deployer.email}"
-}
-
 resource "google_project_iam_member" "deployer_sa_user" {
   // Required so deployer can deploy a Cloud Run revision that runs as the runtime SA
   project = var.project_id