feat: replace GCS TestPermissions health check with probe object round-trip

[antonio-altr]

Problem

The GCS HealthCheck uses bucket.IAM().TestPermissions() to verify that the daserver service account has the required storage permissions. However, GCP's testIamPermissions API has a documented limitation: it does not evaluate conditional IAM bindings. When permissions are granted via a condition (e.g. resource.name.startsWith("projects/_/buckets/my-bucket/objects/my-prefix/")), the API always returns an empty list — even if the service account can actually read and write to the bucket.

Fix

Replace the TestPermissions call with an actual write/read/delete round-trip on a small probe object at <objectPrefix>.health-check-probe. This exercises the real permissions path and works correctly for both unconditional and conditional IAM bindings.

Notes

• The probe object is written and immediately deleted on every health check invocation
• No change to the public API or configuration
• The sort and go-cmp imports are removed as they are no longer used