Refs #2117. This PR covers items 1 and 2. Item 3 (the second Ctrl-C during the remote delete) and item 4 (reporting a possibly orphaned key when CreateKey is interrupted) follow in separate PRs.

Summary

• Item 2: a panic during the credentials upload left the minted key active in GCP. The upload's defer only deleted the key remotely when err != nil. A panic leaves the named err at nil, so the delete was skipped.
  • A done flag is now set just before the success return. The defer treats err == nil && !done as aborted, sets a synthetic error ("upload aborted before completion"), and runs the remote delete and local removal.
  • In that case only, it prints the result to stderr, including the gcloud delete command if the remote delete failed.
  • There is no recover, so the panic still propagates. A normal error return prints nothing extra.
• Item 1: test gap. RemovalFailureReported now asserts deleteCalled is false. Without it, a change that deleted a successfully stored key when only the local unlink failed passed every test.

Evidence (local, macOS, GOTOOLCHAIN=go1.26.9, gcpKeyProvisioner fakes, no GCP calls)

• Fail before / pass after: with the fix stashed, TestWriteServiceAccountKey_PanicDeletesRemoteKey fails (deleteCalled false), and _PanicReportsFailedRemoteDelete fails (stderr empty instead of the gcloud command). With the fix, both pass. assert.Panics keeps the test binary alive.
• Mutation probes:
  • Deleting the key remotely on a local removal failure fails RemovalFailureReported.
  • Dropping done = true fails MintedKeyRemovedAfterSuccess and RemovalFailureReported.
  • Removing the stderr print fails PanicReportsFailedRemoteDelete.
• Checks:
  • make build, go vet ./... and go test -race ./cmd/... pass.
  • The GCP tests pass: 77 tests, from the reviewer's run.
  • golangci-lint v2.10.1 reports 0 issues.
  • scripts/test-git-secrets-allowlist.sh passes 44/44.
• Review: the plan for all four items had two adversarial passes by an independent reviewer (sonnet, high). This diff then had two passes by a second non-author reviewer, who found no actionable findings at ceb773fa.

🤖 Generated with Claude Code