feat(storage/gcs): port GCS driver to S06 (S06 Step 17)

What does this MR do?

S06 Step 17 — Adjust the GCS driver to S06.

Promotes the trimmed GCS driver from internal/storage/_imported/driver/gcs/ into internal/storage/driver/gcs/, adapting Container Registry's driver to S06:

• the narrowed internal/storage.StorageDriver interface,
• the GCSConfig typed parameters,
• the LabKit v2 secret provider for the service-account JSON key,
• AR observability conventions (slog).

The marker-object resume pattern and the 256 KiB chunk-boundary check are preserved verbatim per the spec. Adds the driver-side gofail seams Step 21's e2e fault cases arm: G1a/G1b buffer-flush in flush()/Commit (→ *storage.PartialFlushError), D1a finalize in FileWriter.Commit (final-chunk-with-totalSize), and D1b in StorageDriver.Move. .gitlab-ci.yml and .mise.toml add internal/storage/driver/gcs to the storage-failpoints enable/test/disable lists so the seams compile and run in CI.

The GCS SDK (cloud.google.com/go/storage, google.golang.org/api) is added at current versions, which upgrade the module graph only — labkit/v2 v2.18.0 stays intact, no downgrades or removals.

Mirrors the merged S3 sibling (Step 16, !496 (merged)): offline unit tests run under the default build; real-backend tests are //go:build integration and self-skip when ARTIFACT_REGISTRY_TEST_GCS_BUCKET is unset, so go test ./... stays green by default. fake-gcs-server is intentionally avoided per the spec; the integration suite always exercises real GCS.

Note to the reviewer

A couple of notes for reviewers:

• Local testing. I ran the GCS driver integration suite locally against our real-GCS test worker, multiple times, and it passes. Setting up the proper scheduled CI/CD job for the GCS driver tests is deferred — due to time constraints — to #182 (closed), which now covers both the S3 and GCS real-backend integration jobs.

• Verbatim port. I verified (with Claude's assistance) that the driver was ported verbatim from the Container Registry implementation. Producing a clean, human-reviewable diff between the _imported/ copy and the promoted version would have taken too much time. My first priority was to adjust the CR code to new linting/coding guidelines and behaviour changes. I did a best effort here and pre-adjusted the files in _imported/ directory to match the layout of ported driver. git show HEAD -M10% -C10% produces now somewhat readable diff.

Spec coverage

Spec: docs/specs/S06-storage-layer.md Scope: Step 17 — GCS driver. Acceptance Criteria → StorageDriver (per driver), plus the GCS-relevant Observability, Error-Cases, and Security rows.

Related to #162 (closed)