Fix conditional simulation entrypoint deployment configuration

[anth-volk]

Fixes #3779

What changed

• Use SIM_ENTRYPOINT variables scoped separately to the existing staging and production GitHub Environments as the routing selector.
• Set both Environment variables initially to old_gateway_direct and remove .github/simulation-entrypoint-mode.
• Require only the URL selected by each environment throughout Cloud Run validation and deployment, App Engine packaging, and model-version compatibility checks.
• Keep the verified existing Modal gateway URL in the non-secret OLD_SIMULATION_GATEWAY_URL repository variable.
• Read the future Cloud Run Entrypoint URL from SIMULATION_ENTRYPOINT_URL secrets scoped separately to the existing staging and production GitHub Environments.
• Inject the selector and selected URL into each environment-bound job and deployed service as same-named environment variables.
• Remove every active workflow dependency on the inaccessible legacy SIMULATION_API_URL secret.
• Add regression coverage for both routing modes, missing selected configuration, unselected configuration, and GitHub Environment scoping.
• Update deployment documentation and the changelog fragment.

Why

The first deployment after #3776 required both the existing Modal gateway URL and the future Cloud Run Entrypoint URL. That sequencing was incorrect: API v1 must first deploy safely in direct-Modal mode, before the Cloud Run Entrypoint URL is established, verified, and stored.

The root cause was unconditional routing configuration rather than a selected-upstream contract shared by all deployment consumers. Routing configuration now belongs to the existing protected deployment Environments and becomes runtime environment variables only inside corresponding jobs and deployed revisions.

Impact

The corrective release can deploy through staging and production while API v1 continues calling Modal directly. SIM_ENTRYPOINT is currently old_gateway_direct in both GitHub Environments, and both SIMULATION_ENTRYPOINT_URL Environment secrets remain intentionally unset. After the Entrypoint URL is established and verified, its value can be added separately to both Environment secrets; changing both selectors to cloud_run_simulation_entrypoint then activates the new path for the next qualified release.

Validation

• 66 passed in tests/unit/test_cloud_run_deploy_scripts.py
• 132 passed in the earlier focused selector and deployment suite
• 195 passed across simulation client, gateway contract, economy service, and budget-window compatibility coverage
• Ruff formatting and linting
• Actionlint
• ShellCheck and Bash syntax validation
• YAML parsing
• Migration-contract generation and quality guards
• git diff --check

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.71%. Comparing base (357f7e6) to head (c435b46).
⚠️ Report is 10 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3780   +/-   ##
=======================================
  Coverage   80.71%   80.71%           
=======================================
  Files          74       74           
  Lines        4422     4422           
  Branches      822      822           
=======================================
  Hits         3569     3569           
  Misses        623      623           
  Partials      230      230           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.