Add per-service IBKR env sync plan

[Pigbibi]

Summary

• add CLOUD_RUN_SERVICE_TARGETS_JSON for per-service Cloud Run sync targets
• generate a validated sync plan before updating Cloud Run so slot runtime identity stays service-specific
• keep Telegram/email/push/SMS alert policy shared while ACCOUNT_GROUP, RUNTIME_TARGET_JSON, snapshots, and plugin mounts can differ by slot
• document the slot JSON format and add plan tests that prevent stale shared snapshot env from leaking into per-service targets

Tests

• bash tests/test_sync_cloud_run_env_workflow.sh
• .venv/bin/python -m pytest tests/test_runtime_config_support.py -q -k 'cloud_run_env_sync_plan or print_strategy_switch_env_plan_for_tqqq_growth_income'
• .venv/bin/python -m ruff check .

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fcb9bbf71b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve global safety env fallbacks in per-service mode

When CLOUD_RUN_SERVICE_TARGETS_JSON is used, only names in SHARED_TARGET_FALLBACK_ENV can fall back to repository-level env vars; IBKR_PAPER_LIQUIDATE_ONLY and cash guard vars are omitted from that allowlist even though they are still modeled as target env keys. As a result, existing repo-level settings are interpreted as absent and get pushed into remove_env_vars, so the sync step removes them from every Cloud Run service during migration to per-service mode. This can silently disable liquidation-only / cash-protection runtime safeguards unless operators duplicate those values into every target/default entry.

Useful? React with 👍 / 👎.