feat: rewrite cloudbuild.yaml as full CI/CD pipeline matching deploy.sh

The old cloudbuild.yaml was outdated and unused — it only handled the
agent image with inline CLI flags. This rewrite creates a complete
10-step pipeline that mirrors deploy.sh: builds both service images,
copies the MCP image from Quay.io to GCR, deploys both services using
the YAML configs with sed substitution, configures Pub/Sub, and sets
service URLs. Also documents the Cloud Build workflow in the Cloud Run
and main READMEs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: luis5tb

README.md

@@ -876,12 +876,14 @@ export GOOGLE_CLOUD_LOCATION="us-central1"
 # Run setup script
 ./deploy/cloudrun/setup.sh
 
-# Deploy both services
+# Option A: Manual deployment with deploy.sh
 ./deploy/cloudrun/deploy.sh --service all --build --allow-unauthenticated
 
-# Or deploy individually:
-./deploy/cloudrun/deploy.sh --service handler --allow-unauthenticated
-./deploy/cloudrun/deploy.sh --service agent --allow-unauthenticated
+# Option B: CI/CD pipeline with Cloud Build (builds, pushes, and deploys everything)
+gcloud builds submit --config=cloudbuild.yaml --substitutions=_ALLOW_UNAUTHENTICATED=true
+
+# Option C: Deploy pre-built images from Quay.io (no local build)
+gcloud builds submit --config=cloudbuild.yaml --substitutions=_BUILD_FROM_SOURCE=false,_ALLOW_UNAUTHENTICATED=true
 ```
 
 ## License