Classify SDK tests for Cloud execution

[THardy98]

What was changed?

Temporal SDK tests are now eligible for Cloud execution by default. Tests that cannot run in the isolated Cloud namespace use JUnit 4 categories with one of three explicit reasons: they require a local server, require Cloud resources that CI does not provision, or still need Cloud-specific adaptation. Every exclusion also carries a required CloudTestExclusionNote explaining its concrete limitation.

The new :temporal-sdk:testCloud task excludes that category hierarchy while leaving the normal test task unchanged. Cloud CI now runs the eligible task through the envconfig harness and per-run mTLS namespace introduced by #2998 and #3032 instead of selecting one workflow method by name.

Straightforward compatibility issues were fixed rather than excluded: secondary clients and activity clients inherit the configured namespace and connection options, direct external clients preserve envconfig TLS and authentication, and test assertions use the active namespace. Nexus endpoint and custom search-attribute suites remain explicitly excluded until their required resources can be provisioned.

This PR is stacked on #3032 and should be retargeted to main after the two lower PRs merge.

Why?

A hand-picked Cloud smoke test does not show which parts of the SDK suite are compatible with Temporal Cloud. Runner-native categories keep eligibility beside each test, make exclusions reviewable, and allow new compatible tests to enter the Cloud lane automatically without maintaining a separate allowlist. Machine-enforced notes preserve reviewer context while keeping reason filtering idiomatic to JUnit.

Breaking changes?

None. The category types and Gradle task are internal test infrastructure, and normal local test execution is unchanged.

Server PR

None.

How was this tested?

• ./gradlew :temporal-sdk:test --tests 'io.temporal.testing.CloudTestExclusionTest'
• ./gradlew :temporal-sdk:testCloud --test-dry-run (1,380 tests discovered)
• ./gradlew :temporal-sdk:testCloud (passed)
• ./gradlew :temporal-sdk:test (one unrelated MetricsTest#testStickyCacheSize timing failure passed on isolated rerun)
• actionlint .github/workflows/ci.yml
• ./gradlew spotlessApply
• git diff --check

The stacked lower PRs are green, including the live ephemeral-namespace Cloud lifecycle in #3032. This PR's CI run provides the full Cloud execution result.

Documentation

CONTRIBUTING.md documents the Cloud task, dry-run inventory, default eligibility policy, exclusion reasons, and required note metadata.