roachtest: validate private-address compatibility and roll out auto address mode

Epic: https://github.com/cockroachdb/cockroach/issues/77644

Inventory and design: https://github.com/cockroachlabs/cockroach/pull/2930

## Goal

Prove that roachtest works end to end with private-address GCE clusters, identify and track any remaining incompatibilities, and then change the default address mode from `public` to `auto`.

This is the final integration and rollout tracker, not a replacement for the individual implementation issues.

## Validation matrix

- New default GCE project with `--address-mode=auto`: resolve to private mode and allocate no public node addresses.
- New default GCE project with `--address-mode=public`: preserve the current public behavior as an explicit fallback.
- Non-default GCE project with `--address-mode=auto`: preserve public behavior.
- Representative non-GCE coverage with `--address-mode=auto`: preserve existing public behavior.
- Explicit `--address-mode=private` on unsupported providers: fail clearly rather than silently remaining public.

## Scope

- Run focused smoke tests and recurring canaries in the new default GCE project.
- Exercise cluster create, list/sync, start, grow/shrink, stop, and destroy.
- Exercise SSH, command execution, file transfer, log collection, SQL, Admin UI, profiling, DNS/service discovery, local and centralized monitoring, and failure injection.
- Exercise representative GCP resource-dependent tests covered by the resource-dependency migration issue.
- Exercise managed instance groups, internal load balancers, and the roachmgr backend where those paths are part of the rollout.
- Confirm that private-mode nodes and private managed-cluster load balancers have no public ingress addresses and do not publish public A records.
- Run sufficient nightly/canary coverage to catch missed tests and operational assumptions.
- File and link focused follow-up issues for any incompatibilities discovered during the rollout.
- Document the forced-public fallback and rollback procedure.
- Change the default address mode from `public` to `auto` after the rollout gates pass.

## Rollout gates

- [ ] Applicable address-mode, address-selection, GCE networking, startup/certificate/DNS, roachtest, MIG/load-balancer, and roachmgr implementation issues are complete.
- [ ] [GCP resource-dependency validation for the new project](https://github.com/cockroachdb/cockroach/issues/173121) is complete.
- [ ] The private-mode smoke-test matrix passes.
- [ ] Private-mode canaries/nightlies are stable for an agreed observation period.
- [ ] Forced-public compatibility coverage passes.
- [ ] Monitoring and cleanup confirm that private-mode runs do not leak public addresses, DNS records, or cloud resources.
- [ ] Rollback steps are documented and exercised.
- [ ] The default is changed to `auto` and post-change canaries remain healthy.

Jira issue: CRDB-66432

Start with the linked inventory/design pull request and GCP resource-dependency issue 173121, then use the roachtest address-mode entry point and the listed smoke-test and canary operations as the validation map. Done means the matrix and rollout gates pass, private runs expose no public addresses or records, fallback and rollback are documented, and the default changes to auto without unhealthy post-change canaries.

Written by the indexing model from the issue text.