fix: cloud-platform not included when services filter active (P2)

[grep999]

Fixes #918

What

• Fixed scope_matches_service() to respect narrowed services filter: cloud-platform only passes through when services filter is empty or cloud-platform explicitly included.
• Removed always-include PLATFORM_SCOPE re-injection in run_discovery_scope_picker.

Verified

• cargo check clean
• cargo test pass (709 passed)

How tested

• Added test_scope_matches_service_cloud_platform_only_matches_when_explicitly_selected() with three cases: narrowed filter excludes, explicit inclusion passes, empty filter preserves legacy pass-through.
• All existing tests pass.

P2 impact

• Addresses P2 bug 918: cloud-platform scope incorrectly re-added after deselection in picker UI.
• Respects user intent: when services filter narrowed (--services gmail), cloud-platform is NOT automatically added.
• --scopes flag unaffected and produces exactly what user requested.
• No impact on --services without scopes.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a1a56b3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[googleworkspace-bot]

/gemini review