Filter runtime guard logs by ready revision

[Pigbibi]

Summary

• pass CLOUD_RUN_REGION into the runtime guard workflow
• resolve the latest ready Cloud Run revision for each service
• use the latest ready revision creation time as the lower bound for Cloud Run log queries, falling back to the original lookback window when metadata is unavailable
• add focused tests for revision cutoff and target-specific region resolution

Validation

• python -m py_compile scripts/cloud_run_runtime_guard.py tests/test_cloud_run_runtime_guard.py
• uvx ruff check scripts/cloud_run_runtime_guard.py tests/test_cloud_run_runtime_guard.py
• stdlib inline simulation of _cloud_run_log_since

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7440e23196

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add the ready revision to the log filter

When a Cloud Run service has split traffic or an older revision finishes requests after a new revision becomes ready, this query still reads every revision because it only filters by service_name and timestamp. The repo already treats non-latest traffic revisions as a supported state in .github/workflows/sync-cloud-run-env.yml:809-816, so old-revision failures after latestReadyRevisionName was created can still page the runtime guard; include resource.labels.revision_name for the resolved ready revision if the guard is meant to isolate the ready revision's logs.

Useful? React with 👍 / 👎.