Bucket retention policies and malicious actors

You can use the Pub/Sub notifications for Cloud Storage to get notifications about different events done to your storage objects:

Pub/Sub notifications sends information about changes to objects in your buckets to Pub/Sub, where the information is added to a Pub/Sub topic of your choice in the form of messages. For example, you can track objects that are created and deleted in your bucket. Each notification contains information describing both the event that triggered it and the object that changed.

As for the notifications about uploads, it looks like you could use the OBJECT_FINALIZE event.

Alternatively, have a look at the Object change notifications.

For the expenditure control there is also a way to set up notifications as described in the budget alerts documentation:

A budget enables you to track your actual Google Cloud spend against your planned spend. After you've set a budget amount, you set budget alert threshold rules that are used to trigger email notifications. Budget alert emails help you stay informed about how your spend is tracking against your budget. You can also use budgets to automate cost control responses.

There are also some examples of cost control responses like sending alerts to Slack or disabling billing to stop usage.