refactor(cmd): move GCP key provisioning into configure_gcp_keys.go

[cristim]

Refs #1834. This is part 1 of the configure_gcp.go split. Part 2 will bring that file under the 500-line cap.

Summary

This PR moves the GCP service-account key provisioning group out of cmd/configure_gcp.go into a new cmd/configure_gcp_keys.go. The move changes no logic, signatures, names, or comments; the only other edits are to the imports. configure_gcp.go goes from 1069 lines to 839, and the new file is 243 lines.

Moved symbols:

• gcpKeyProvisioner, iamKeyProvisioner (with its CreateKey and DeleteKey methods), newIAMKeyProvisioner
• createKeyError
• createGCPServiceAccountKey, deleteGCPServiceAccountKey
• writeServiceAccountKey, uploadGCPCredentialsFile, deleteMintedGCPKeyRemotely
• gcloudDeleteKeyCommand, mintedGCPKeyFilename, newMintedGCPKeyPath, removeMintedGCPKey

The callers that stay in configure_gcp.go are getGCPCredentialsFilePath and gcpStepCreateKey. They are part of the wizard flow, so they belong there.

Evidence (local, macOS, GOTOOLCHAIN=go1.26.9)

• Pure move: after excluding the package line and import blocks, the sorted removed and added lines from git diff -U0 are identical. Both the author and an independent reviewer checked this.
• go build -o /dev/null ./cmd passes. go vet ./... passes. go test -race ./cmd/... passes, including 92 GCP tests.
• golangci-lint v2.10.1 reports 0 issues. scripts/test-git-secrets-allowlist.sh passes 44/44.
• Review: two passes by an independent non-author reviewer (sonnet, high) found no actionable findings at bc21eaba.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • GCP credential and service-account key operations now clean up temporary local files and, where possible, remote keys after failures. Error messages also provide clearer recovery guidance when a key may have been created despite an error.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 385fc528-7fe5-42c9-8dce-6d2093e20f3d

📥 Commits

Reviewing files that changed from the base of the PR and between 0c869b4 and e03f2c6.

📒 Files selected for processing: 2

• cmd/configure_gcp.go
• cmd/configure_gcp_keys.go

💤 Files with no reviewable changes: 1

• cmd/configure_gcp.go

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

The GCP key-management and credential-upload helpers move from configure_gcp.go to configure_gcp_keys.go. The file contains IAM key provisioning, local key-file creation and cleanup, credential upload, and remote-key deletion handling.

Changes: GCP key lifecycle

Layer / File(s)	Summary
IAM key provisioning cmd/configure_gcp.go, cmd/configure_gcp_keys.go	The IAM provisioner creates and deletes service-account keys. Create errors are classified by HTTP status, with possible key-creation uncertainty reported for non-4xx errors.
Key-file creation and cleanup cmd/configure_gcp.go, cmd/configure_gcp_keys.go	The key-file writer reserves the destination with exclusive creation and mode 0600, then decodes and writes the key data. Decode or write failures trigger remote-key deletion. Temporary key files and their directories are removed during cleanup.
Credential upload and rollback cmd/configure_gcp.go, cmd/configure_gcp_keys.go	Credential upload stores loaded credentials and removes the local key on every return path. If upload fails, the helper attempts remote-key deletion and reports cleanup failures. Interrupted uploads are reported while panics continue to propagate.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Refactor

Merge Risk: ⚪ Minimal · up to e03f2

No actionable change to GCP key provisioning or credential upload behavior is established; the PR appears mergeable after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: moving GCP key provisioning into configure_gcp_keys.go.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 1 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}