Sync cloud-sdk-go v0.14.1

[anekkanti]

Sync cloud-sdk-go v0.14.1

Keeps cloud-cli pinned to the current state of the cloud-sdk-go
releasecandidate/v0.14.1 branch and exposes the new SDK API surface in the
CLI. Runs before the SDK RC is merged so the downstream CLI work can be
reviewed alongside the SDK candidate.

Source candidates

• SDK RC PR: Sync cloud-api v0.17.1 cloud-sdk-go#57 — Sync cloud-api v0.17.1
  (Sync cloud-api v0.17.1 cloud-sdk-go#57)
• Originating cloud-api tag: v0.17.1
• SDK RC branch releasecandidate/v0.14.1 @ e6c2bafd1bf5e2fcbdbfcb7ff1086cabcbb47b7a

Dependency bump

• go.temporal.io/cloud-sdk: v0.13.0 → v0.14.1-0.20260616191445-e6c2bafd1bf5
• Pinned to the exact RC commit e6c2bafd1bf5e2fcbdbfcb7ff1086cabcbb47b7a
  (go get go.temporal.io/cloud-sdk@e6c2bafd1bf5e2fcbdbfcb7ff1086cabcbb47b7a), then go mod tidy.
• Shared dependencies were checked against the SDK's go.mod on the RC branch
  (e.g. go.temporal.io/api, the genproto modules). cloud-cli already
  requires versions at or above everything the SDK declares, so MVS keeps the
  existing (higher) versions — no alignment downgrade was needed and no drift
  was introduced.

SDK changes detected (v0.13.0 → RC)

Purely additive — no removed, renamed, or signature-changed symbols.

New RPCs on CloudService (all read-only, paginated):

• GetUserNamespaceAssignments(namespace, page_size, page_token) → users []UserNamespaceAssignment
• GetServiceAccountNamespaceAssignments(namespace, page_size, page_token) → service_accounts []ServiceAccountNamespaceAssignment
• GetUserGroupNamespaceAssignments(namespace, page_size, page_token) → groups []UserGroupNamespaceAssignment

New identity message types (each: id, name/email/display_name, namespace_access, inherited_access, resource_version):

• identity/v1.UserNamespaceAssignment
• identity/v1.ServiceAccountNamespaceAssignment
• identity/v1.UserGroupNamespaceAssignment

New enum value:

• region/v1.Region_CloudProvider: CLOUD_PROVIDER_AZURE = 3. No CLI code
  change required — cloud-provider values render automatically via the existing
  RegisterEnumToStringConverter[...Region_CloudProvider] registration in
  commands.go, so cloud region get/list will display Azure regions once the
  SDK is bumped.

CLI changes

Existing commands updated: none. (No wrapped SDK method changed signature or
gained fields; the only field-level additions are on the brand-new assignment
types.)

New commands added (read-only, mirroring existing list conventions; each
takes the standard required --namespace/-n, optional --page-size,
--page-token, and --api-key/--server):

• cloud namespace user list — wraps GetUserNamespaceAssignments
• cloud namespace service-account list — wraps GetServiceAccountNamespaceAssignments
• cloud namespace user-group list — wraps GetUserGroupNamespaceAssignments

Implemented in temporalcloudcli/commands.namespace.access.go with unit tests in
commands.namespace.access_test.go. commands.yml, the generated
commands.gen.go, and the regenerated cloudservice mock are updated
accordingly. make all (gen + build + mocks + test) passes.

Backward compatibility

No backward-incompatible changes were made — additions only. No existing
command, subcommand, flag, positional argument, default, type, or output was
removed, renamed, or changed. All new flags are optional with safe defaults
(empty/zero), so existing invocations behave identically. Nothing had to be
skipped for compatibility reasons.

RC pseudo-version note

This pins an RC pseudo-version (v0.14.1-0.20260616191445-e6c2bafd1bf5),
not a published tag. Once cloud-sdk-go v0.14.1 is released, the dependency
should be re-pinned to the tagged version. That is a separate, human-driven
follow-up and is out of scope for this PR.

---

Note

Medium Risk
Touches identity and namespace access visibility (authorization-adjacent), but changes are read-only with no mutation of assignments or existing command behavior.

Overview
Adds read-only cloud namespace subcommands to inspect who has access to a namespace, wired to new cloud-sdk Get*NamespaceAssignments RPCs.

cloud namespace user list, service-account list, and user-group list each take --namespace plus optional --page-size / --page-token, and print direct vs inherited access (table/JSON via existing printer conventions).

Command definitions land in commands.yml with regenerated commands.gen.go; handlers live in commands.namespace.access.go with unit and table-output tests in commands.namespace.access_test.go.

^{Reviewed by Cursor Bugbot for commit ddfb464. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{Reviewed by Cursor Bugbot for commit b851fc2. Configure here.}