Refs #1834. This is part 1 of the configure_gcp.go split. Part 2 will bring that file under the 500-line cap.

Summary

This PR moves the GCP service-account key provisioning group out of cmd/configure_gcp.go into a new cmd/configure_gcp_keys.go. The move changes no logic, signatures, names, or comments; the only other edits are to the imports. configure_gcp.go goes from 1069 lines to 839, and the new file is 243 lines.

Moved symbols:

• gcpKeyProvisioner, iamKeyProvisioner (with its CreateKey and DeleteKey methods), newIAMKeyProvisioner
• createKeyError
• createGCPServiceAccountKey, deleteGCPServiceAccountKey
• writeServiceAccountKey, uploadGCPCredentialsFile, deleteMintedGCPKeyRemotely
• gcloudDeleteKeyCommand, mintedGCPKeyFilename, newMintedGCPKeyPath, removeMintedGCPKey

The callers that stay in configure_gcp.go are getGCPCredentialsFilePath and gcpStepCreateKey. They are part of the wizard flow, so they belong there.

Evidence (local, macOS, GOTOOLCHAIN=go1.26.9)

• Pure move: after excluding the package line and import blocks, the sorted removed and added lines from git diff -U0 are identical. Both the author and an independent reviewer checked this.
• go build -o /dev/null ./cmd passes. go vet ./... passes. go test -race ./cmd/... passes, including 92 GCP tests.
• golangci-lint v2.10.1 reports 0 issues. scripts/test-git-secrets-allowlist.sh passes 44/44.
• Review: two passes by an independent non-author reviewer (sonnet, high) found no actionable findings at bc21eaba.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • GCP credential and service-account key operations now clean up temporary local files and, where possible, remote keys after failures. Error messages also provide clearer recovery guidance when a key may have been created despite an error.