Read remaining Gateway metadata with protected parallel identities

[Pigbibi]

Summary

• Add an opt-in metadata-only mode for the three protected inventory targets other than the existing matched target.
• Use each target's existing restricted cloud identity, with concurrency three and independent failure results.
• Validate exact project, zone and instance response identity; keep diagnostic output restricted to fixed statuses and inventory indices.
• Preserve the default single-target behavior and prevent the new mode from entering SSH, key retrieval or Gateway connection steps.

Validation

• Actual workflow resolver synthetic regression passed.
• Metadata matcher: 10 unit tests passed; root independently reran both suites.
• Related diagnostic and connection workflow shell guards passed.
• Actionlint, Python compile and diff checks passed.
• Independent review found no required corrections within this metadata-only scope.

Actual cloud metadata reads will be verified separately after merge. This does not establish broker authentication, balances or trading health.