Rather surprised they didn't migrate from App Engine to Cloud Run. This would seem like the simpler and more direct migration path.
"App Engine nginx load balancer provides an off-the-shelf SSL certificate managed by Google."
You're welcome. I started the support request for this feature and fought for it for... if I recall, over 5 years. I think over 7. It was a running joke in the thread. You could use Let's Encrypt and generate the certificates in Google Compute using an off the shelf script, then copy & paste the results into App Engine settings. There was no excuse they couldn't automate this. I gave them all my scripts, showed where the buttons should go in their interface and explained the simple things they should do. Eventually they listened. Pretty soon after launching (6 months?) they switched to signing the certs themselves rather than using Let's Encrypt directly, but the feature remained.
I would be interested in seeing this type of article for migrating an established App Engine "standard" environment application instead of the "flexible" environment, which is basically managed containers.
The first-generation standard App Engine service was/is a PaaS environment that provided a lot of functionality on top of the basic load balancing servers, such as an automatically high availability distributed NoSQL datastore, memcache, task queues, mail services, cron, and some special libraries. So migrating off of this involves not just the infrastructure but also a considerable amount of re-implementing equivalent services.