Hi,
Wordfence writes to these files/directories on regular basis, especially if you have "Caching" enabled in (Wordfence > Performance Setup), also when you first configure the firewall settings.
It's really hard to enumerate when/how Wordfence writes to these files/directories mentioned.
I agree with you -theoretically- regarding the installation and configuration of the plugin locally then deploying it on GAE, however I'm not sure about how sustainable this installation will be.
I'm sorry for not being too helpful, but as I told you earlier this isn't a standard server installation that we support.
Thanks.