Fix shadow execution report identity

[Pigbibi]

What changed

• prefer the actual Cloud Run / runtime-target service identity over the shared account-group service name
• persist the runtime target account scope in execution reports while preserving the broker account group
• add regression coverage for a shadow target sharing a live account group

Root cause

The shadow runtime reused a live account group. Report assembly inherited that group's live service name and account scope, so Execution Report Heartbeat correctly rejected the shadow report.

Impact

Future shadow reports identify the shadow Cloud Run service and us-combo-shadow scope without changing broker routing, positions, orders, or execution mode.

Validation

• python -m pytest -q tests/test_runtime_config_support.py tests/test_runtime_composer.py tests/test_request_handling.py tests/test_execution_report_heartbeat.py tests/test_runtime_heartbeat_policy.py — 158 passed
• python -m ruff check runtime_config_support.py application/runtime_composer.py tests/test_runtime_config_support.py tests/test_runtime_composer.py — passed
• git diff --check — passed

No /run or /dry-run endpoint was triggered.