GCP Cloud Storage Canary Collection

In an explicitly authorized exercise, retrieve exactly one predesignated synthetic canary object from a controlled Google Cloud Storage bucket to a controlled local test destination using an authenticated gcloud principal that already has read permission. This is T1530 Data from Cloud Storage (Collection); use the exact object name without a wildcard or prefix pattern, and do not enumerate unrelated buckets, recurse through objects, or handle customer data.