Run Cloud-eligible integration tests with filtering

[THardy98]

What was changed

Integration-test modules now declare Cloud exclusions where they are composed with
cloud_test_module_exclusion!; individual tests in mixed modules use
#[cloud_test_exclusion(...)]. Both forms take a fixed reason and an optional note. Tests without
an exclusion are Cloud-eligible by default.

When the integration runner receives --cloud, it compiles only eligible tests, prints their
inventory, and fails if none remain. Normal integration runs and Clippy continue to compile the
complete suite. The trusted Cloud job runs the selection through the envconfig-backed client and
isolated namespace added in #1483.

Why?

Cloud policy should be visible where test suites are maintained without depending on generated
libtest names. Module-level exclusions keep the classification compact: complete suites need one
declaration, while mixed suites can still exclude a specific test.

Checklist

1. Part of Run integration tests against cloud features#851.

2. How was this tested:

   • cargo +1.94 test -q -p temporalio-macros
   • cargo +1.94 integ-test -s external --cloud -- --list selects the existing timer test.
   • cargo +1.94 lint
   • cargo +1.94 test-lint
   • actionlint -ignore 'SC2086' .github/workflows/per-pr.yml

3. Any docs updates needed?

   Yes. The README documents module- and function-level Cloud exclusions and inventory listing.