feat(traffic): add Cloud Run puller foundation

[arberx]

Summary

Starts the server-side traffic ingestion stack with the provider-neutral model and Cloud Run / Cloud Logging adapter foundation.

This PR intentionally does not add public API, CLI, MCP, or dashboard traffic surfaces yet. The new code is a reusable integration package and shared contract layer so the next stacked PR can add persistence and public reads/writes in one complete API/CLI slice.

What changed

• Added traffic source/evidence contract constants and NormalizedTrafficRequest in @ainyc/canonry-contracts.
• Added @ainyc/canonry-integration-cloud-run with:
  • Cloud Logging filter construction for cloud_run_revision;
  • optional service, location, timestamp, request URL, and user-agent narrowing;
  • entries.list pull support with page tokens;
  • normalization from LogEntry.httpRequest into Canonry request evidence.
• Added @ainyc/canonry-integration-traffic with local, provider-neutral crawler/referrer classification and hourly rollups over normalized request events.
• Added scripts/test-cloud-run-traffic-pull.ts plus a fixture so we can test pull -> normalize -> ingest -> analyze before wiring Canonry DB/API/CLI surfaces.
• Added a provider source model review documenting raw-event vs aggregate-bucket adapters across Cloud Run, WordPress, Cloudflare, and Vercel.
• Updated the server-side ingestion plan to point at the source model review.
• Bumped root and package versions to 3.3.0.

Local probe

Fixture mode:

pnpm tsx scripts/test-cloud-run-traffic-pull.ts \
  --fixture scripts/fixtures/cloud-run-traffic-sample.json

Real Cloud Run logs:

pnpm tsx scripts/test-cloud-run-traffic-pull.ts \
  --gcp-project <gcp-project-id> \
  --service <cloud-run-service> \
  --location <region> \
  --since 6h \
  --url-contains ainyc.ai \
  --use-gcloud \
  --out .tmp/cloud-run-traffic-report.json

Use --narrow-bots only when testing crawler detection specifically; it lowers Cloud Logging volume but misses human AI referrals.

Validation

• pnpm run typecheck
• pnpm run lint
• pnpm -r --no-bail run test
• pnpm --filter @ainyc/canonry-integration-cloud-run test -- --runInBand
• pnpm --filter @ainyc/canonry-integration-cloud-run typecheck
• pnpm exec eslint scripts/test-cloud-run-traffic-pull.ts packages/integration-cloud-run/src packages/integration-cloud-run/test
• pnpm exec tsc --noEmit --target ES2022 --lib ES2022,DOM,DOM.Iterable --module NodeNext --moduleResolution NodeNext --types node --skipLibCheck scripts/test-cloud-run-traffic-pull.ts
• pnpm tsx scripts/test-cloud-run-traffic-pull.ts --gcp-project openclaw-nyc --service openclaw-nyc --location us-east1 --since 6h --url-contains ainyc.ai --use-gcloud --page-size 1000 --max-pages 3 --out .tmp/ainyc-cloud-run-traffic-report.json
• pnpm tsx scripts/test-cloud-run-traffic-pull.ts --gcp-project openclaw-nyc --service openclaw-nyc --location us-east1 --since 6h --url-contains ainyc.ai --narrow-bots --use-gcloud --page-size 1000 --max-pages 3 --out .tmp/ainyc-cloud-run-traffic-bots-report.json
• commit hook reran pnpm -r run lint