… Dockerfile

Independent finding, found while checking a same-day fix (commit
6eb1d35, "fix: validate app_name before interpolating into deploy
Dockerfile") for completeness during a routine commit-batch audit.
That fix closed a Dockerfile-instruction-injection vulnerability
where an unvalidated app_name was spliced verbatim into
_DOCKERFILE_TEMPLATE's COPY instructions and CMD.

Checking for sibling gaps found the same template also interpolates
--project and --region verbatim into
  ENV GOOGLE_CLOUD_PROJECT={gcp_project_id}
  ENV GOOGLE_CLOUD_LOCATION={gcp_region}
with zero validation, across all three deploy targets (to_cloud_run,
to_agent_engine, to_gke).

Dynamically confirmed with the real, unmodified _DOCKERFILE_TEMPLATE
extracted from the source: a --project value containing a newline
followed by a RUN instruction produced a generated Dockerfile where
that RUN instruction appeared as its own, independent line -- meaning
docker build processing that Dockerfile would execute the
attacker-supplied command as part of the build.

Fix adds _validate_gcp_project_id/_validate_gcp_region, mirroring the
already-merged _validate_app_name (same character-set-only
restriction, deliberately not attempting to fully replicate GCP's own
project-ID length/format rules, since the security goal is excluding
characters that can break out of a Dockerfile instruction). Applied
at all three deploy functions. In to_agent_engine specifically,
project is validated only after its own onboarding flow (triggered
when --project is not supplied) has had a chance to run and resolve a
real value -- validating immediately after the initial
_resolve_project() call incorrectly rejected that legitimate
empty-then-resolved-later case during development.

Verified: re-ran the PoC against the patched validation -- the
malicious --project value is now rejected with a clear error before
reaching the template. Added 8 new regression tests: acceptance of
plain identifiers (including the existing suite's own short/
underscored fixtures, e.g. "proj", "fake_region"), rejection of the
injection payload and several other unsafe characters, and end-to-end
rejection through to_cloud_run and to_gke. Full existing
test_cli_deploy.py suite: 117/117 pass (109 pre-existing + 8 new), no
regressions.