Add Workflow host conformance after plugin protocol migration

[intel352]

Problem\nThe IaC conformance gate added for DO/AWS cannot be honestly applied here yet. The current GCP entrypoint is a CLI-style main.go that prints provider info and does not serve the Workflow external plugin protocol via sdk.Serve or sdk.ServeIaCPlugin.\n\n## Expected migration\n- expose a real Workflow plugin subprocess entrypoint\n- declare accurate provider discovery metadata in plugin.json\n- add min/current Workflow engine host conformance once the plugin can be loaded through external.NewExternalPluginManager\n\n## Reference\nSee GoCodeAlone/workflow-plugin-digitalocean#94 and GoCodeAlone/workflow-plugin-aws#6 for the initial conformance pattern.

[intel352]

Added current wfctl plugin conformance probe result from origin/main (2026-05-11):

/tmp/wfctl-conformance plugin conformance --mode typed-iac --build-package . --engine-version v0.51.3-0.20260511092920-8e4247812e6d --format json --output conformance-evidence.json .

Result:

error: Unrecognized remote plugin message: workflow-plugin-gcp dev

This confirms the issue body: the current root main.go behaves like a CLI/info command, not a Workflow external plugin subprocess. Cutover order should be:

1. add a real Workflow plugin entrypoint
2. add strict typed-IaC server wrapper satisfying pb.IaCProviderRequiredServer
3. add plugin.contracts.json / current manifest provider metadata
4. add push-only executable conformance CI only after local typed-IaC conformance passes.

[intel352]

Antagonistic rollout review clarification:

Until this migration lands and wfctl plugin conformance --mode typed-iac passes, GCP should be treated as not registry-compatible for enforced typed-IaC evidence. This is especially important here because the current executable is a CLI/info binary; future archive executable discovery must prove Workflow go-plugin handshake + typed service registration, not just select an executable file.

Smoke must be metadata-only: no GCP credentials, no cloud mutation, no secret/env dump, no resource Read/Plan/Apply/Destroy/bootstrap/credential RPCs.

[intel352]

Resolved via the cloud-SDK extraction + strict-contracts cutover work. Current state verified 2026-05-16:

• cmd/workflow-plugin-gcp/main.go serves via sdk.ServeIaCPlugin (typed IaC gRPC contract; legacy sdk.Serve surface removed per strict-cutover)
• .github/workflows/iac-host-conformance.yml is in place — IaC Host Conformance gate tests against minEngineVersion + WORKFLOW_CURRENT_VERSION, matching the DO #94 / AWS Add Workflow host conformance after plugin protocol migration #6 pattern
• plugin.json declares minEngineVersion + iacProvider metadata

Closing as RESOLVED. The boundary problem cited (gcp uses CLI-style main.go without sdk.Serve) was resolved when the plugin migrated to sdk.ServeIaCPlugin via the cloud-SDK extraction pipeline (workflow-plugin-gcp v1.1.0 shipped 2026-05-15).