fix(purchase): extract failed-account save helper to stay under gocyclo:10

The new `if saveErr != nil` audit-loss branch added to executeForAccount on
this PR pushed its cyclomatic complexity from 10 to 11, tripping the
`gocyclo -over 10` pre-commit hook (and leaving the PR UNSTABLE on
three retries).

Hoist the credential-failure save into a tiny `persistFailedAccountExecution`
helper so executeForAccount drops back to 10 while the audit-loss surfacing
behaviour and the new regression test
(TestExecuteForAccount_CredentialFailure_SaveErrorSurfaced) remain
identical: the helper still does `errors.Join(AUDIT LOSS..., cause)` on
save-failure and returns `cause` unchanged on success, so neither the
credential error nor the save error can be silently dropped.

- gocyclo -over 10 internal/purchase/execution.go: clean (executeForAccount=10).
- go vet ./internal/purchase/...: clean.
- go test ./internal/purchase/... -count=1: 207 passed.

Author: cristim

internal/purchase/execution.go

@@ -230,16 +230,11 @@ func (m *Manager) executeForAccount(ctx context.Context, baseExec *config.Purcha
 		acctExec.Status = "failed"
 		acctExec.Error = err.Error()
 		credErr := fmt.Errorf("credential resolution failed for account %s: %w", account.ID, err)
-		// The failed row is as much a part of the audit trail as a success
-		// row: if persisting it fails, surface that loss exactly like the
-		// post-purchase save below does instead of silently dropping it.
-		if saveErr := m.config.SavePurchaseExecution(ctx, &acctExec); saveErr != nil {
-			return false, errors.Join(
-				fmt.Errorf("AUDIT LOSS: failed to save execution record for account %s: %w", account.ID, saveErr),
-				credErr,
-			)
-		}
-		return false, credErr
+		// Audit-trail save: the failed row is as much a part of the audit
+		// trail as a success row, so a save failure must surface (AUDIT LOSS)
+		// instead of being silently dropped. Extracted to a helper to keep
+		// executeForAccount under the gocyclo:10 budget.
+		return false, m.persistFailedAccountExecution(ctx, &acctExec, account, credErr)
 	}
 
 	accountID := account.ExternalID
@@ -297,6 +292,22 @@ func (m *Manager) executeForAccount(ctx context.Context, baseExec *config.Purcha
 	return committed, nil
 }
 
+// persistFailedAccountExecution writes a per-account execution row that the
+// caller has already stamped with Status="failed" + Error, and joins any save
+// failure with the originating cause via errors.Join so neither error is
+// silently dropped (the row is as much audit trail as a success row; issue
+// #1184 / COR-10). Extracted from executeForAccount so the new branch keeps
+// that function under the gocyclo:10 budget.
+func (m *Manager) persistFailedAccountExecution(ctx context.Context, acctExec *config.PurchaseExecution, account config.CloudAccount, cause error) error {
+	if saveErr := m.config.SavePurchaseExecution(ctx, acctExec); saveErr != nil {
+		return errors.Join(
+			fmt.Errorf("AUDIT LOSS: failed to save execution record for account %s: %w", account.ID, saveErr),
+			cause,
+		)
+	}
+	return cause
+}
+
 // resolveSingleAccountProvider derives per-account credentials for the
 // single-account execution path. Returns (nil, "", nil) when no account can be
 // identified (ambient credentials are used in that case), or when no recs are