fix(acs-ci): pin legacy GCP metadata endpoints

[robbycochran]

The Jira preflight now passes. Legacy gsutil still receives a metadata 403 because its apitools credential path uses GCE_METADATA_ROOT/GCE_METADATA_IP rather than the newer OpenShell provider variables.

Set both variables to OpenShell's loopback metadata emulator in both task workflows, and set them explicitly on the gsutil process in preflight.

Validation:

• YAML parses for workflow and policy files
• git diff --check

Summary by CodeRabbit

• Bug Fixes
  • Improved connectivity between CI workflows and the local OpenShell metadata emulator.
  • Updated GCS checks to consistently use the local metadata endpoint, preserving existing timeout and error-handling behavior.
  • Maintained read-only access restrictions for test result storage.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a3ffb0d9-afac-495e-892f-152943670d15

📥 Commits

Reviewing files that changed from the base of the PR and between ccffb77 and 19e2ade.

📒 Files selected for processing (3)

• tasks/acs-ci-nightly/openshell/README.md
• tasks/acs-ci-nightly/workflow/harness.yaml
• tasks/acs-ci-nightly/workflow/preflight.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 7 remain after this review.

---

Walkthrough

The change configures both legacy gsutil metadata variables for the OpenShell loopback emulator in the README and nightly workflow environments. The preflight GCS check uses the same endpoint without changing its timeout or error handling.

Changes

Metadata endpoint configuration

Layer / File(s)	Summary
OpenShell metadata settings tasks/acs-ci-nightly/openshell/README.md	The configuration sets both legacy gsutil metadata variables to the OpenShell loopback emulator and retains read-only test-platform-results-public endpoints.
Nightly workflow metadata settings tasks/acs-ci-nightly/workflow/harness.yaml, tasks/acs-ci-nightly/workflow/preflight.yaml	The sandbox environments set GCE_METADATA_IP. The preflight GCS check sets both metadata variables to 127.0.0.1:8174 while preserving its 30-second timeout and existing success and failure handling.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 19e2a

The metadata configuration is consistent across the nightly workflow and local emulator, with no concrete merge-blocking risk established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning the legacy GCP metadata endpoints for ACS CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}