feat: allow passing gcloud ADC credentials into local custom-action / verify containers via runArgs volume mount

Problem

When running skaffold exec (custom actions) or skaffold verify locally, containers run in an isolated Docker environment with no access to the host's Google credentials. This means any container that needs to call a Google Cloud API via Application Default Credentials (ADC) will fail with an authentication error — even if the developer has valid credentials on the host (gcloud auth application-default login).

In contrast, when the same pipeline runs in Cloud Deploy, the execution environment already runs as a specified Google Service Account and ADC works out of the box. This creates a local/remote parity gap: pipelines that call Google APIs (BigQuery, Cloud SQL, Vertex AI, etc.) cannot be tested locally with skaffold exec / skaffold verify.

Reproduction

A typical verify test or custom action that calls a Google API:

verify:
  - name: bq-query-test
    executionMode:
      local: {}
    container:
      name: bq-test
      image: google/cloud-sdk:slim
      command: ["bq"]
      args: ["query", "--nouse_legacy_sql", "SELECT 1"]

Running skaffold verify locally produces:

[bq-test] ERROR: (gcloud.auth.application-default.print-access-token)
[bq-test] Could not automatically determine credentials.

Proposed solution

Expose a runArgs whitelist on executionMode.local (for both customActions and verify) that accepts a conservative set of docker run flags. The user can then bind-mount their local ADC credentials directory into the container to replicate what Cloud Deploy provides automatically:

customActions:
  - name: reuse-local-adc
    executionMode:
      local:
        runArgs:
          - "-v=/root/.config/gcloud:/root/.config/gcloud:ro"
          - "--network=host"
    containers:
      - name: gcloud
        image: google/cloud-sdk:slim
        command: ["gcloud"]
        args: ["auth", "list"]

This also works for skaffold verify:

verify:
  - name: bq-query-test
    executionMode:
      local:
        runArgs:
          - "-v=${HOME}/.config/gcloud:/root/.config/gcloud:ro"
    container:
      name: bq-test
      image: google/cloud-sdk:slim
      command: ["bq"]
      args: ["query", "--nouse_legacy_sql", "SELECT 1"]

The whitelist is intentionally small (--network, -v/--volume, --add-host, --tmpfs) — only flags that map to the Docker HostConfig and have clear, bounded blast radius.

References

• PR #10066 implements this feature (feat: local runArgs whitelist for custom actions and verify)
• Cloud Deploy managed execution environment: https://cloud.google.com/deploy/docs/execution-environment