Wire ensure_break_glass into cloud node launch path

`CloudProvider.ensure_break_glass` (apps/api/app/clouds/base.py:241) is implemented by the AWS, Azure and GCP adapters (apps/api/app/clouds/aws.py:372, apps/api/app/azure/provider.py:700, apps/api/app/gcp/provider.py:347) and asserted by their adapter tests, but NO production code calls it. `git log -S 'ensure_break_glass('` shows the method arrived with the provider protocol (Task 8772) and no commit ever removed a caller: the launch path never wired it. Consequences today: - GCP: the IAP ingress rule (`gcp/network.py::ensure_iap_rule`) is only created for the auto network (`_ensure_auto_network`); a connection on a named network gets no break-glass rule, although `cloud_node_launch.py:60` and `gcp/provider.py:20` document that `ensure_break_glass` makes it best-effort. - Azure: the "cannot run Run Command / boot diagnostics" warning that `ensure_break_glass` returns never reaches the admin, although `cloud_node_launch.py:43` says it "names the grant". Ask: call `provider_for(provider).ensure_break_glass(cred, conn)` once per launch on the shared launch path (apps/api/app/cloud_node_launch.py / durable/cloud_node.py, wherever the other post-resolve warnings are gathered) and surface the returned warning on the node order / launch warnings the console already shows. Keep the protocol's contract (a warning or None, never raises). Add a launch-path test per provider proving the call happens and the warning is surfaced; the existing adapter tests stay. Out of scope: changing what each adapter checks, the IAP rule body, the AWS SSM profile cron, or any console UI beyond showing the warning where launch warnings already appear. Done means: - A launch on a GCP connection with a named network creates `iap_rule_name(network)` (fake provider records the `ensure_break_glass` call; `apps/api/tests/fake_cloud.py:209` already records it). - A launch whose adapter returns a warning shows that warning on the node's launch/order record; one that returns None adds nothing. - `./dc check quick` green; changed-area tests `apps/api/tests/test_cloud_node_launch.py`, `test_gcp.py`, `test_azure_adapter.py` green.

launch_cloud_node now calls ensure_break_glass once per launch. The warning is stored on nodes.infra and shown in the node page's machine section. Quick gate and changed-area tests pass, review lane clean, visual check OK. PR #7670 queued in the lane. Memory: none applied.