ci: add real-driver storage conformance jobs (S06 Step 21)

What

S06 plan Step 21 (#166 (closed)), CI half: the jobs that run the real-driver conformance instrumentation added in the stacked implementation MR (!601 (merged)). Split out so the code lands first.

Runs the storage conformance suite against the real pgBlobStore + a real driver, alongside the existing low-level driver jobs, with gofail failpoints enabled (unarmed scenarios skip, so there is no point running without them):

• conformance:s3-seaweedfs — self-contained PostgreSQL + SeaweedFS services on the shared runner; validates the full suite (happy path + every applicable fault) on every MR, no real-cloud infra needed.
• conformance:gcs-key-creds — real GCS with static key creds on the default GCP runners, with a PostgreSQL service; fails fast if the key-file variable is missing.

Conformance runs against a single auth flavour per backend (static key); the workload-identity flavour stays covered by the driver-level jobs. Each job enables the gofail seams, runs the TestRealDriver suite, and disables them in after_script.

The earlier conformance:s3-aws job was dropped: the workload-identity custom runner does not provide reachable services: (the postgres hostname does not resolve even with FF_NETWORK_PER_BUILD), and conformance only needs one auth flavour. Real-AWS S3 stays validated at the driver layer (test:integration:s3-aws).

Related to #166 (closed)

🤖 Generated with Claude Code