fix(deploy): scope Cloud Run runtime env rendering to selected job

[tianmind-studio]

Summary

• add a --job mode that renders shared Cloud Run network flags and only the selected job
• use the scoped renderer in the manual/auto memory-maintenance and notifications workflows
• keep static workflow validation aligned with the renderer's output scope

Root cause

Job-only workflows invoked the renderer without a scope, so it eagerly resolved every Cloud Run service and job in the manifest. A missing service-only value such as GOOGLE_CLIENT_ID could therefore stop an unrelated maintenance-job deployment before its own outputs were emitted.

Unknown job names now fail before any output, while existing unscoped service deployment workflows retain the full-render behavior.

Closes #9747.

Validation

• python -m pytest -q backend/tests/unit/test_render_backend_runtime_env.py backend/tests/unit/test_backend_runtime_env_validator.py backend/tests/unit/test_preflight_cloud_run_deploy.py backend/tests/unit/test_workflow_contracts.py (82 passed)
• backend/scripts/typecheck.sh (0 errors)
• validate-backend-runtime-env.py --env dev --check-workflows
• validate-backend-runtime-env.py --env prod --check-workflows
• actionlint on all three changed workflows
• Black 24.4.2 and Ruff 0.4.4 on changed Python files

[tianmind-studio]

Fresh main evidence after #9751: Auto Deploy Memory Maintenance Job to Development run https://github.com/BasedHardware/omi/actions/runs/29365024461 failed again in Render backend runtime env before authentication or deploy. The memory-maintenance workflow still invokes the unscoped renderer, which traverses the unrelated backend service and raises ValueError: GOOGLE_CLIENT_ID requires to be set. This PR's --job memory-maintenance-job selector is the direct fix; all PR checks, including the backend unit suite, are green.

[Git-on-my-level]

Thanks for the focused fix here. I reviewed the workflow/runtime-env changes and ran the relevant backend deploy contract tests locally against e96739bc91cefb9701a9ef2fe47943cb8099ab8f:

• python -m pytest -q backend/tests/unit/test_render_backend_runtime_env.py backend/tests/unit/test_backend_runtime_env_validator.py backend/tests/unit/test_preflight_cloud_run_deploy.py backend/tests/unit/test_workflow_contracts.py → 82 passed

The --job scoping looks like the right direction for the maintenance/notifications workflows: it still emits the shared Cloud Run network flags, limits job output rendering to the selected job, and avoids resolving unrelated service env vars before these job deploys can run. The static validator update also matches that narrowed output surface, and the regression coverage covers the failing class plus the changed workflow invocations.

Because this touches GitHub Actions / deploy automation, I’m not formally approving it from automation. Maintainer review should still confirm the workflow/deploy intent before merge, but I did not find a blocking code issue in this pass.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.