Classify SDK tests for Cloud execution

[THardy98]

What was changed?

Temporal SDK tests are now eligible for Cloud execution by default. Tests that cannot run in the isolated Cloud namespace use JUnit 4 categories with one of three explicit reasons: they require a local server, require Cloud resources that CI does not provision, or still need Cloud-specific adaptation. Every exclusion also carries a required CloudTestExclusionNote explaining its concrete limitation.

The new :temporal-sdk:testCloud task excludes that category hierarchy while leaving the normal test task unchanged. Cloud CI now runs the eligible task through the envconfig harness and per-run mTLS namespace introduced by #2998 and #3032 instead of selecting one workflow method by name.

Straightforward compatibility issues were fixed rather than excluded: secondary clients use the configured namespace and connection, direct external clients preserve envconfig TLS and authentication, and assertions use the active namespace. Tests that need to combine envconfig with test-specific service or client options are explicitly classified as NeedsCloudAdaptation; option composition intentionally remains outside the minimal harness. Nexus endpoint and custom search-attribute suites remain excluded until their required resources can be provisioned.

This PR is stacked on #3032 and should be retargeted to main after the two lower PRs merge.

Review guide

The commits separate filtering infrastructure, annotation-only classifications, compatibility adaptations, and the CI switch. Reviewers can inspect the large mechanical classification commit independently from behavioral changes.

Why?

A hand-picked Cloud smoke test does not show which parts of the SDK suite are compatible with Temporal Cloud. Runner-native categories keep eligibility beside each test, make exclusions reviewable, and allow new compatible tests to enter the Cloud lane automatically without maintaining a separate allowlist. Machine-enforced notes preserve reviewer context while keeping reason filtering idiomatic to JUnit.

Breaking changes?

None. The category types and Gradle task are internal test infrastructure, and normal local test execution is unchanged.

Server PR

None.

How was this tested?

• CloudTestExclusionTest and the namespace manager tests pass together.
• After rebasing onto current main and classifying its new incompatibilities, testCloud --test-dry-run discovers 1,428 eligible tests.
• The previous CI Cloud run passed the full filtered suite against an ephemeral namespace and deleted the namespace successfully. The first current-main run identified five newly added classification gaps and also deleted its namespace successfully; the refreshed run validates those exclusions.
• ./gradlew :temporal-sdk:test (one unrelated MetricsTest#testStickyCacheSize timing failure passed on isolated rerun)
• actionlint .github/workflows/ci.yml
• ./gradlew spotlessApply
• git diff --check

git range-diff confirms that the four filtering patches are unchanged apart from import context required by current Nexus APIs.

Documentation

CONTRIBUTING.md documents the Cloud task, dry-run inventory, default eligibility policy, exclusion reasons, and required note metadata.