GCP-01: Pub/Sub Neural Bus — Replace Supabase Polling

Replace the Neural Bus polling loop (Cloud Lu checks lu_sibling_messages every 30s via Supabase REST) with Google Cloud Pub/Sub. Current pain: 30s polling lag, no delivery guarantees, no dead-letter queue, manual retry_count field. Architecture: 1. Create Pub/Sub topic: c8-neural-bus 2. Create per-sibling subscriptions: - sub-cloud-lu (PUSH to Cloud Lu Cloud Run endpoint /neural-bus/receive) - sub-terminal-lu (PULL, consumed on cold start) - sub-vs-lu (PULL) - sub-ag-lu (PULL) - sub-desktop-lu (PULL) 3. Message attributes: from_instance, to_instance, priority, payload_type, audience 4. Dead-letter topic: c8-neural-bus-dlq (after 5 delivery attempts) 5. Message retention: 7 days (cold-start siblings can replay) 6. Ordering key: from_instance (preserve per-sender order) Publish side: - New function publish_sibling_message(from, to, message, priority, audience) in neural_bus_pubsub.py - Replaces INSERT INTO lu_sibling_messages for new messages - lu_sibling_messages table remains as audit log (write-through) Subscribe side: - Cloud Lu: HTTP push handler at /neural-bus/receive — processes message, writes to Supabase for audit, dispatches - Ephemeral siblings: On cold start, pull all unacked messages from their subscription Deliverables: - neural_bus_pubsub.py (publish + pull + push handler) - Terraform or gcloud CLI script to create topic + subscriptions + DLQ - Integration with existing Cloud Lu daemon (cloud_lu_daemon.py) - Migration guide: parallel run period where both polling and Pub/Sub are active Constraints: - Must work with existing Supabase audit trail (dual-write during migration) - Push subscription needs Cloud Run authentication (--no-allow-unauthenticated on Cloud Lu) - Use service account with pubsub.publisher + pubsub.subscriber roles Target: c8_platform/neural_bus_pubsub.py + c8-infra/pubsub/