fix: scope GCP firewall rules per node

[korshunowroman]

Summary

• scope each GCP firewall rule to the node it protects
• make destroy use the exact same per-node rule names as deploy
• add regression coverage for multi-node creation and cleanup

Root cause

Firewall rules were created with global names such as allow-ssh while their
target tag was node-specific. After the first node, later deployments saw the
global rule and skipped creation, leaving their VM without the required
ingress. The destroy path already looked for suffixed names such as
allow-ssh-node-1, so it could never remove the rules created by deploy.

Validation

• uv run ruff check deploy_gcp/seismic_deploy/gcp/compute.py deploy_gcp/seismic_deploy/gcp/test_compute.py
• uv run ty check deploy_gcp/seismic_deploy/gcp/compute.py deploy_gcp/seismic_deploy/gcp/test_compute.py
• uv run python -m unittest discover -s deploy_gcp -p 'test_*.py' -v
• python3 -m compileall -q deploy_gcp tee
• git diff --check

Legacy unsuffixed firewall rules from older deployments are intentionally not
deleted automatically because their target tags may belong to another node.