Adopt environment deployment coverage into gcp-apigee-proxy-health (from #729)

[Rohit-Ekbote]

Follow-up to #748 (merged). PR #729 is an independent generation of this same
bundle (registry issue #159); its six runbook tasks were reviewed against the
merged implementation and one carried a finding nothing here could reach.

Adopted: Check Apigee Environment Deployment Coverage

Flags environments hosting zero deployed API proxies — the environment axis
of the same inventory every other check reads from the proxy axis.
check_failed_deployments asks "is this proxy deployed anywhere?", so an org
whose proxies all live in prod answers yes for every proxy while an empty
test sits serving nothing. A hostname routed there via an environment group
returns an edge-level error rather than a proxy response.

The new partialcoverage fixture is exactly that case, and asserts both that
coverage fires and that every proxy-side check stays silent.

Two correctness guards #729 does not have, because a scope filter can otherwise
manufacture the finding:

• a PROXIES filter removes deployments from the inventory, so an environment
  hosting only filtered-out proxies would look empty — the check refuses to
  judge and says why in the report;
• an ENVIRONMENTS filter is the opposite case: the topology records every
  environment unfiltered while deployments are filtered, so the environment
  list is narrowed to what the run actually looked at.

It counts deployments, not healthy deployments. Gating on state == "READY"
would make every environment look empty the moment the deployment status view
became unreadable, and would re-report what check_deployment_state owns.
Asserted from both sides via the statusunknown and broken fixtures.

Not adopted, and why

#729 task	Verdict
Discover Proxies and Deployments	Discovery is suite setup here, deliberately: as a task, a discovery failure showed up as one issue while every dependent check reported "no issues found" — they had found nothing because they could not look.
Proxy Deployment Health	Already covered.
Revision and Approval State	Already covered — its "draft state" finding is the undeployed-proxies task, its stale-revision finding is the revision drift task.
Runtime Environment Status	See below.
Health Summary	Raises no finding a per-condition check does not, and re-reports every one of them a second time.

Runtime Environment Status — verified broken, and in the wrong bundle

It queries Cloud Monitoring for apigee.googleapis.com/environment/active. The
metric is real, but the check misreads it three ways — all verified against the
live metric and monitored-resource descriptors:

• Its filter matches nothing. It filters on
  resource.labels.environment_name. The apigee.googleapis.com/Environment
  monitored resource has resource_container, org, env, location — no
  such label. The query returns no time series, so the check reads zero data
  points and silently reports nothing, always.
• It misreads the metric. environment/active is a GAUGE whose documented
  description is "Number of current environments attached to Apigee
  instance" — a count of attached environments, not a per-environment
  liveness flag.
• It sums a gauge over the window. Sixty one-minute points of "2 attached"
  yields 120, compared against zero.

Read correctly it measures environment-to-instance attachment, which
gcp-apigee-environment-health already checks directly through the Apigee API
(Check Apigee Environment to Instance Attachment Coverage). Inferring it from
a metric here would duplicate that bundle's finding by a weaker route.

STALE_REVISION_THRESHOLD deliberately not adopted

#729 flags a stale revision only when the gap exceeds the threshold and
defaults the threshold to 1, so a proxy one revision behind is never
reported. The revision drift task here flags any gap; adopting that default
would have silently weakened an existing check.

All of the above is recorded in the bundle README so it is not re-litigated.

Verification

• ./.test/offline/run.sh — 301 passed, 0 failed (was 262)
• ./.test/render/run.sh — 15 passed, 0 failed
• shellcheck -S style over 15 scripts — exit 0
• robot --dryrun — 9 tasks, 9 passed
• 25 mutations, all detected against a green baseline, including four new
  ones: coverage silenced, coverage narrowed to READY-only, and each of the two
  scope-filter guards removed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NLcdGCtY4qZH8tW5MKDEvi