Show the service account used in a pipeline run (run view)

[Mbeaulne]

Summary

Can't easily see which service account a run actually used. Debugging what-worked-vs-what-didn't ate a lot of time; showing the effective SA would be a big speedup.

Problem

• Run view doesn't surface the effective SA the run/task executed as.
• SA differences (default vs custom, per-cloud) are a common works/doesn't-work cause. Today you reverse-engineer it.
• The "Custom Google Cloud Service Account" task annotation (chore: Task Details - Annotations - Added the "Custom Google Cloud Service Account" task annotation #1198) covers input config — not the effective SA displayed per run.

Desired

• Show the effective SA in the run view (run-level, and per-task if they differ) — task details / run metadata.
• Include cloud/project context (GKE vs Nebius).

Acceptance

• Opening a run shows the SA it ran as, with no cluster/CLI digging.

Related

• chore: Task Details - Annotations - Added the "Custom Google Cloud Service Account" task annotation #1198 — custom SA task annotation (input side).
• May need backend to expose effective SA per run/task → requires backend.

Reported by Matt Beaulne (@matt.beaulne) via River.