IBB security verification round 2: metadata identity names + gradle-level env names (no tokens, will close)

[athulk-star]

Follow-up verification for the report following #40032 (same IBB research). Names-only again, strictly nothing sensitive read:

• conftest: lists service-account emails and instance attribute names from the GCP metadata service (no token endpoints requested), instance descriptors (name/zone/machine-type), docker socket presence, and a no-data egress nonce to webhook.site.
• tox common.gradle: prints gradle-level environment variable names in a preCommitPy doFirst (verifying whether workflow-level credential variables are present at the build-script layer; values are not printed).

Will be closed once logs are captured. Thank you!

[github-actions]

Checks are failing. Will not request review until checks are succeeding. If you'd like to override that behavior, comment assign set of reviewers