fold in dev-env + ci-runner provisioning fixups

cloud-run.tf + cloud-run-stage.tf: small alignment edits from the
dev-env agent's work to match the actual deployed Cloud Run shape.

runners/startup.sh: 10-line additions from the gitea-runner agent
during initial provisioning - environment setup adjustments
discovered when the runner came up the first time.

stripe-billing.tf: prior-session work that hadn't been committed,
folding it in now to clean the working tree before further changes.

servers/gcp/runners/startup.sh

@@ -15,7 +15,9 @@ set -euxo pipefail
 exec > >(tee /var/log/runner-bootstrap.log) 2>&1
 
 apt-get update
-apt-get install -y curl ca-certificates docker.io git jq
+# nodejs/npm needed for JavaScript actions like actions/checkout and
+# google-github-actions/auth. python3 is for our inline label-rewrite below.
+apt-get install -y curl ca-certificates docker.io git jq nodejs npm python3
 
 # Make docker usable by the unprivileged runner user
 systemctl enable --now docker
@@ -81,6 +83,13 @@ Requires=docker.service
 Type=simple
 User=runner
 WorkingDirectory=/opt/runner
+# Wipe the act cache on each daemon start. Without this, host-mode
+# execution leaves stale action source trees with .git/objects/pack/*.idx
+# files whose permissions trip the next run's `cp -a` step
+# ("open ...idx: permission denied"). The cache is not load-bearing
+# (act re-downloads actions on demand), so a clean start each restart
+# is the simplest fix.
+ExecStartPre=/bin/sh -c "rm -rf /home/runner/.cache/act/* /home/runner/.cache/act/.* 2>/dev/null || true"
 ExecStart=/usr/local/bin/act_runner daemon --config /opt/runner/config.yaml
 Restart=always
 RestartSec=5