chore(deps): bump cloud-commitments-go pins to main 9dae64b

[cristim]

Closes #60

Bumps the four cloud-commitments-go pins to v0.0.0-20261012130811-9dae64b216d4 (go #337, #338, #339; platform equivalent: platform#791 / PR #805).

• tools/archera_comparison.go: key built with insurance.NewSecret, Reveal() kept for archeraError redaction. archeraError stays as defense in depth (transport, validation and context errors are not covered by the library); stale go#336 comment reworded.
• New tests: key with inner space / zero-width / non-ASCII is rejected with zero requests and no key in the text (fail on the old pin); CRLF env key is trimmed; decode errors show an identifier but not hostile text.
• Providers source is unchanged between the old and new pin, so no purchase-tool behaviour change.

Verification (macOS): go test -short ./tools, -race -count=3 ./tools, ./ and ./cmd/..., GOWORK=off -mod=readonly build, golangci-lint 0 issues. Fixture/mock based; no live calls.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 4 billable files and costs up to $1.00.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 40 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 64 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-mcp/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 5117deaf-ebc1-464d-9068-206056df055d

---

📥 Commits

Reviewing files that changed from the base of the PR and between f061fcb and 4375779.

---

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

---

📒 Files selected for processing (4)

• CHANGELOG.md
• go.mod
• tools/archera_comparison.go
• tools/archera_comparison_test.go

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Gate review (independent, Opus 5.5): APPROVE at 4375779

Fixture-based local verification on macOS, GOTOOLCHAIN=go1.26.9, from git archive of the head. No live calls.

1. Pins: all four modules at v0.0.0-20261012130811-9dae64b216d4; proxy.golang.org .info resolves to 9dae64b216d4 (go main HEAD, behind_by=0). go.sum h1 hashes match go mod download -json. go.work is use . only, no replace, no vendor. GOWORK=off go build -mod=readonly ./... ok; go mod tidy leaves go.mod/go.sum identical.
2. diff -r of providers/aws, azure, gcp between the two pins: identical. pkg diff is insurance only: Secret (closure, Format + MarshalText redact), Config drops its Format and json:"-" (APIKey now marshals as "[redacted]"), printable-ASCII key rule (error names byte index only), sanitizeDecodeError (keeps Unwrap, so errors.Is/As for context still works), describeVendorValue, Retry-After ErrRange clamp, cleanMessage strips Cf/Zl/Zp. No mcp code marshals or logs a Config; it lives only in a local in handle().
3. Fails-before reproduced: origin/main code + the 3 new tests -> RejectsUnusableKey (inner space, zero-width, non-ascii) and DecodeErrorShowsIdentifierOnly FAIL; TrimsEnvKey passes before (pin test, TrimSpace predates this PR).
4. Head: go test -race -count=3 ./... ok (root, cmd/cudly-mcp, tools); vet ok; golangci-lint 0 issues. archeraError mutants at head (no strip / no skeleton / no cap / no ReplaceAll) all still killed.
5. Key probe: fmt %v %+v %#v %s %q %x %X %p %d %T %60v, json.Marshal, slog JSON+text on Config, *Config, Client, *Client, tool, a struct holding Config in an unexported field, Secret, slices/maps: 132 fmt combos, no key.
6. Mutants on the new tests: 8 run, 7 killed (lib: no key loop, allow 0x20, allow >0x7e, regex allows space, never show identifier, wrong byte count; mcp: drop env TrimSpace), 1 survived (see note B).
7. Diff is CHANGELOG, go.mod, go.sum, tools/archera_comparison{,_test}.go only; mcpb/, server.json, manifests untouched. Labels equal chore(deps): bump cloud-commitments-go pins to main 9dae64b (#337, #338, #339) #60's. CI all green, CodeRabbit status SUCCESS (review rate-limited; optional per the gate), mergeStateStatus CLEAN.

Non-blocking notes (no change required for merge):

• A: TestArcheraDecodeErrorsAreBoundedAndClean no longer exercises the tool's own strip/cap, because the library now withholds the hostile value before archeraError sees it (the no-cap mutant was killed by it on origin/main, not at head). The cap stays covered by TestArcheraErrorMasksKeyAfterSanitizing/straddles_cap and transport-path tests, so the second layer is still pinned.
• B: if the library ever echoed the key with %q in its key-rule error, the zero-width case would reach the user as the escaped text key​-0000, and the test (NotContains raw key) would not catch it. This is a library-side regression the library's own tests guard; an optional follow-up could assert on a key fragment instead.