configure-gcp currently grants full Compute Admin access before minting a service-account key. Replace that grant with Compute Viewer and a project custom role containing only compute.commitments.create.

The wizard validates existing custom roles before binding them and refuses to widen conditional-only membership. It preserves existing grants, including broad grants from older installations, which need separate operator review. Setup documentation distinguishes operator permissions from runtime permissions and notes separate Recommender access requirements.

Validation uses the real wizard coordinator and Google SDK against local HTTP fixtures. The regression fails on the original Compute Admin policy request. Cases cover custom-role reuse and rejection, preserved conditional and broad grants, create conflicts, and partial policy-write failure before key minting. No live IAM mutation or purchase was performed; fixture evidence does not establish live Google IAM propagation.

Verified commit: 1272e721b8d5185634840c9aa9fc7698dd7cb124.

• Full short/race suite: passed, 468.281 seconds.
• Final focused regression: passed, 27.920 seconds.
• Build, Go vet, pinned golangci-lint 2.10.1 and normal commit hooks: passed.
• Independent adversarial review by gpt-6-astra under the user-approved session substitution: approved this exact SHA, no actionable findings. Independent focused race run passed in 26.000 seconds; unchanged fixture against original production failed on the intended Compute Admin assertion in 3.180 seconds. CodeRabbit was waived for this independent review path.

Closes #1946

Summary by CodeRabbit

• New Features
  • GCP setup now grants the permissions needed for commitment purchasing without granting the broader Compute Admin role.
  • Setup creates the required project role when it is missing and verifies that an existing role has only the required permission.
• Bug Fixes
  • Setup now stops when the existing role is incompatible or access is granted only through conditional IAM bindings, rather than broadening access.
• Documentation
  • Updated the cloud setup guide with the required permissions and behavior when rerunning setup.