docs(cli): describe what configure-gcp actually checks first

[cristim]

Closes #2257

Summary

The configure-gcp "What it does" section of docs/cli/cloud-setup.md repeated a sentence from configure-azure about creating Azure resources. That is wrong for GCP, which creates no Azure resources. This PR corrects that sentence, fixes the other stale facts in the same section, and documents the new cleanup behaviour. The configure-azure section is unchanged.

• Preflight: configure-gcp first loads the AWS config, honouring --profile, and stops there if that fails, before it creates any GCP resource or key (cmd/configure_gcp.go:153, :302-312). It resolves AWS credentials only when the secret is written.
• Steps:
  • Adds the gcloud auth application-default login step.
  • The project listing is an SDK call with its own [R]un ... or [S]kip prompt, and it runs unless you enter s/skip.
  • gcloud config set project runs without a prompt.
  • Both custom roles are named.
  • The key is minted through the SDK into a private temporary directory, and the local copy is removed after upload.
  • The "[r]un, [S]kip (default)" note now mentions the listing exception.
• Cleanup:
  • Ctrl-C during key creation or upload finishes cleanup (up to 60s), and a second Ctrl-C aborts immediately (fix(cli): let a second Ctrl-C abort the GCP key cleanup #2240).
  • A failed upload removes the local key and deletes the remote one. If that delete fails, the error names the key (fix(cli): delete the minted GCP key when the credentials upload panics #2233).
  • An ambiguous CreateKey failure warns that a key may exist, with the gcloud commands to list and delete it (fix(cli): warn that a GCP key may exist when CreateKey fails ambiguously #2244).

Evidence

• An independent non-author reviewer (sonnet, high) checked every changed sentence against cmd/configure_gcp.go on origin/main, citing file:line for each, over two passes.
  • Pass 1 caught an accidental edit to the configure-azure section. It is reverted, so git diff touches only the configure-gcp section.
  • Pass 2 found no actionable findings at 02f07b1.
• markdownlint and the pre-commit hooks pass.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 32 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 057af852-1e6b-4b16-9d4d-5f4f1faffc07

📥 Commits

Reviewing files that changed from the base of the PR and between 45f5920 and 02f07b1.

📒 Files selected for processing: 1

• docs/cli/cloud-setup.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent review verdict: CLEAN at 02f07b1

Reviewer: fresh Claude agent (Sonnet 5.5, high effort), not the author, cold brief. Every changed sentence was checked against the code on origin/main (cmd/configure_gcp.go unless noted). Coordinator: claude-cc-reviewer.

Blocking findings: none.

Verified

• Preflight: loadAWSConfigForGCP runs first, honours --profile and fails loud (:153, :302-312). AWS credentials are resolved only later, in storeGCPCredentials. The old "no Azure resource" error no longer exists.
• Step order:
  1. login, then ADC login, both with [r]un/[S]kip (~:745);
  2. project listing;
  3. gcloud config set project;
  4. service account;
  5. roles;
  6. key (~:695-720).
• Listing prompt: skips only on s or skip (azure.go:58-70).
• Service account: named cudly-service-account.
• Roles: cudlyCommitmentPurchaser, cudlyRecommendationReader (:857) and roles/compute.viewer.
• Key: written to a 0700 temp dir, and the local copy is removed after upload.
• Failure paths:
  • Ctrl-C has a 60 s limit, and a second Ctrl-C aborts.
  • A failed upload cleans up the local and remote key, and names the gcloud command if the remote delete fails (~:228-248).
  • A non-4xx CreateKey error warns that a key may exist (~:574).
• Other docs: README.md:36 and docs/cli/README.md:7 do not contradict this.

Non-blocking notes (follow-up candidates)

1. "Except for the project listing, each step prompts" also does not apply to step 3 (gcloud config set project, ~:775-790). The doc's own step 3 already says it runs without a prompt.
2. Step 4's prerequisite, enabling recommender.googleapis.com (:899), is not mentioned in this section. It is documented at cloud-setup.md:169.
3. The guided flow is also skipped when --credentials-file is set (~:270-282). This was already missing before this PR.

Local verification: this is a docs-only change, so verification is the code trace above. No configure-gcp run was made, because it would make cloud calls.

Gate

• Labels are mirrored from docs(cli): configure-gcp section repeats the Azure-only AWS-preflight sentence #2257.
• CodeRabbit has posted no reviews or comments. Exact-revision verification plus this review cover the SHA.
• Merge once CI is green.