Problem

The external_auth_oidc_gcp task on v8.3-staging and v9.0-staging fails before any tests run because GCP setup installs unpinned dependencies into the shared resmoke virtual environment.

evergreen/external_auth_gcp_setup.sh runs python -m pip install google-cloud-compute. Its transitive google-api-core dependency upgrades opentelemetry-api while the locked opentelemetry-sdk and exporter remain at 1.35.0. The timeout helper imports resmoke's FileSpanExporter and fails with:

ImportError: cannot import name '_ExtendedAttributes' from 'opentelemetry.util.types'

Evidence

• BF-46628 currently groups 20 failures across the two staging branches.
• Last passing v9.0 revision d050571d76 installed API 1.44.0 and passed all three tests.
• First failing v9.0 revision 1b1b319d52 installed API 1.45.0. Relevant setup scripts and lockfile did not change between these revisions.
• Latest runs on both branches install API 1.45.1 while SDK remains 1.35.0 and fail in determine task timeout.
• The S3 403 messages are nonfatal; GCP VM creation succeeds before the import failure.

Scope

Fix master, v8.3-staging, and v9.0-staging. Master also installs GCP dependencies into the shared environment and locks OpenTelemetry at 1.43.0. A local compatibility check against the GCP-installed API 1.45.1 reproduces a missing _ExtendedAttributes error. Master runs the GCP OIDC task in mongodb-mongo-master-nightly; the BF's lack of a master instance does not rule out this incompatibility.
Use a dedicated virtual environment with a pinned dependency set for the GCP VM management helper in both setup and teardown. Run its Python commands with -I to ignore PYTHONPATH and prevent its dependencies from modifying or importing resmoke's environment. Keep the helper environment under Evergreen's existing venv directory so normal cleanup removes it.
Keep the package specific to this task; SERVER-86761 removed it from global dependencies to avoid cross-platform build failures.

Acceptance Criteria

• GCP setup and teardown preserve the shared resmoke environment's dependency versions.
• Regression coverage verifies setup/teardown isolation and error handling.
• external_auth_oidc_gcp passes on master-nightly and both staging branches.