Separate App Engine deploy image build from push-time tests

[anth-volk]

Fixes #3523

Summary

• move push-time API tests out of the App Engine Docker build and into ordered staging deploy steps
• make local .env setup explicit instead of a side effect of make install
• add a staging deploy-image build check before the real App Engine deploy

Details

• remove make test from the App Engine Dockerfile build path
• run make test on the GitHub runner inside deploy-staging before deploy
• add helper scripts to prepare the App Engine bundle and verify the image builds
• stop .env.example from actively setting a fake GOOGLE_APPLICATION_CREDENTIALS path

Validation

• bash -n .github/scripts/prepare_app_engine_bundle.sh .github/scripts/build_app_engine_image.sh .github/scripts/deploy_app_engine_version.sh .github/setup_env.sh
• `ruby -e 'require "yaml"; YAML.load_file(".github/workflows/push.yml"); puts "ok"'

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.68%. Comparing base (939b716) to head (6597d52).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3524   +/-   ##
=======================================
  Coverage   76.68%   76.68%           
=======================================
  Files          63       63           
  Lines        3444     3444           
  Branches      620      620           
=======================================
  Hits         2641     2641           
  Misses        629      629           
  Partials      174      174           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.