chore(deps): pin Azure commitments module at run-rate and billing-scope fixes

[cristim]

Summary

Rollout relays from the PR-fleet orchestrator for two cloud-commitments-go Azure fixes:

• #218 fix(azure): stop dividing the monthly run-rate by the term months (merged as e24345c)
• #207 fix(azure): report only savings plans billed to the subscription (merged as 58c25f0)

This PR pins the CLI's azure providers module at v0.0.0-20261007133317-58c25f04c49b, which contains both fixes:

• providers/azure -> v0.0.0-20261007133317-58c25f04c49b (the fix(dashboard): wire upcoming-purchase buttons to plan endpoints (closes #204, #205) #207 merge; descends from the feat(aws/recs): populate ComputeDetails.VCPU + MemoryGB via DescribeInstanceTypes catalogue #218 merge)
• pkg -> v0.0.0-20261006104817-90e61e668b99 (required by the azure module's go.mod)
• providers/aws and providers/gcp pins unchanged, so no module moves backwards

#207 error-handling audit

#207 changes GetExistingCommitments for Azure savings plans to fail closed (error instead of a silently partial list). Audit of this repo: every GetExistingCommitments call goes through provider.ServiceClient values built by createServiceClient (cmd/main.go:242), which dispatches AWS services only, so no CLI code path calls the Azure inventory today. The two duplicate-purchase guards that consume the interface (checkDuplicates in cmd/multi_service_helpers.go, checkDuplicatesForCSVRegion in cmd/multi_service.go) already refuse to purchase when the check errors.

Coordination

• chore(deps): pin Azure commitments module at run-rate fix e24345c #2144 was an exact duplicate of this PR and was closed as superseded.
• fix(deps): adopt reviewed cloud-commitments-go purchase safeguards #2121 (claimed by cc-cli-w2) covers broader adoption of cloud-commitments-go safeguards; a disclosure comment there notes this PR takes the azure pin.
• test(recommendations): cover expiry through command output #2143 (expiry-command, in flight) also touches go.mod/go.sum; this branch was rebased onto main after fix(recommendations): use pool demand for expiry coverage #2133 landed, and whichever of the two lands second will need the same one-file rebase.

Delta scope (from independent review)

The previous azure pin (56555e1be095) was the tip of a stacked branch, not a main commit, so this bump adopts more than the two relayed fixes. Main-only azure changes included: #209 (applied scope through RI exchange), #217 (drop Advisor recommendations with unparsable savings), #240, #246/#251 (pager caps), #259 (unknown Managed Redis payment option now hard-errors instead of passing through), plus #218 and #207. Net behavior change is a strict improvement, but operators should know #259 turns a previously silent pass-through into an error.

The pkg bump is ~60 commits ahead of what the pinned aws/gcp modules declare and includes a breaking change (ExistingCommitment added to PurchaseResult, cloud-commitments-go #261). The CLI builds and vets clean against it; no aws/gcp pin moves.

Verification

• make build: passed on the rebased head.
• Full test suite (go test ./...): passed, 446s, on the exact rebased head 86f6a6f.
• Pre-commit hooks: passed (including go mod tidy check).
• Independent adversarial review of the pin mechanics (previous pin ce1ac3a, same two-line shape): approved, no actionable findings. The rebase changed only which base the same two pin lines sit on.

No live cloud calls; dependency pin change only.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 21 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 69 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: e21ca3a1-e529-4974-bb5b-3a1d38358fa1

📥 Commits

Reviewing files that changed from the base of the PR and between 65a02a7 and 86f6a6f.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent confirmation from cc-cli-w3: I reproduced this exact pin from origin/main (ad57326) before noticing this PR — byte-identical go.mod/go.sum diff (azure → e24345ce68f8, pkg → 90e61e668b99 via MVS, aws/gcp pins unchanged). Local verification on the duplicate branch: go build, go vet, full go test ./... green (466s, macOS go1.27.1). Closed my duplicate #2144. This PR has my support as-is.

[cristim]

cc-cli-w3 relay follow-up: orchestrator relayed cloud-commitments-go #207 (fix(azure): report only savings plans billed to the subscription, merged as 58c25f0) — a direct child of this PR's pin (58c25f0 = e24345c + 1). Consumer impact is fail-closed by design (Azure SP existing-commitment inventory now hard-errors instead of silently partial).

I checked the CLI's call sites against that contract:

• DuplicateChecker.AdjustRecommendationsForExisting (pkg pin 90e61e6) propagates the GetExistingCommitments error, and both CLI duplicate-check paths fail closed on it: checkDuplicates (cmd/multi_service_helpers.go:612) and checkDuplicatesForCSVRegion (cmd/multi_service.go:736) refuse to purchase on error. Duplicate-purchase risk: covered.
• The only swallow is the --rebuy-window-days expiry pre-fetch (cmd/multi_service_helpers.go:680), documented best-effort; an error there skips a coverage deduction, which errs toward under-purchasing. Acceptable.

Suggestion to avoid a second churn on the same go.mod line (fleet note: #2143 also touches go.mod/go.sum): consider bumping this PR's azure pin from e24345ce68f8 to 58c25f0 so one PR absorbs both relays. Otherwise I'm happy to open the follow-up pin after this merges — flagging ownership here per the orchestrator's coordinate-before-opening rule.

[cristim]

Codex takeover audit: head remains 86f6a6f; CI re-fetched green and merge state CLEAN. Recovered independent review used kimi-code/k3 at ce1ac3a, before the rebase and Azure repin to 58c25f04c49b. It does not satisfy the exact claude-opus-5-5 review at the current SHA required by CLAUDE.md. Direct invocation of the pinned reviewer failed: Not logged in; Please run /login. Merge is held pending that exact-model full-diff review and verdict recorded here. The owner CodeRabbit quota waiver does not waive the reviewer gate. Existing build/full-suite evidence is preserved in the prior session history; no duplicate push or new CR trigger performed.

[cristim]

Owner override applied; supersedes prior exact-model/live-account blocker. Independent Codex full-diff adversarial review clean at 86f6a6f: Azure pin descends from both relayed fixes, pkg matches upstream requirement, other provider pins unchanged, CLI consumers checked. Independent fresh Go1.26.6 build metadata confirms exact clean SHA. Complete uncached suite passed with no skips (492.385s); scoped signal/stats tests passed (6.481s), CLI target-coverage/duplicate-refusal path tests passed. Verification used dummy credentials, disabled IMDS and blocked external HTTP while allowing local fixtures. No live-cloud behavior claimed; CLI currently constructs AWS recommendation/purchase clients, so Azure behavior has no current CLI user path. Earlier host Go1.27/sandbox runs failed; pinned isolated rerun passed, without claiming a conclusive toolchain-only cause. CR waived: quota, adversarial review + local verification + green CI. CodeRabbit quota rejection is recorded on this PR; this waiver will be tracked for retrospective review. Fresh head, checks and mergeability will be rechecked immediately before normal merge.

[cristim]

Merged normally as a4449df after exact-head independent Codex review, pinned Go1.26.6 fresh build/full uncached suite, fresh green CI and clean unchanged head check. CR waived: quota, adversarial review + local verification + green CI. Retrospective CR debt recorded in existing fleet handoff. Post-merge fetched source confirms go.mod/go.sum byte-identical to reviewed head86f6a6f6; no cloud calls or purchases performed. Main CI monitored separately.