Credential enhancements

[mattreid]

The default was clashing with another tool's credentials. Adds a new default env token COSTPULLER_CREDENTIALS which will take precedence over GOOGLE_APPLICATION_CREDENTIALS, if present. Enhances logging around credential discovery and usage, and moves those under -debug output when needed. This helped me diagnose the clash.

Assisted by: Cursor

[ciaramulligan]

The PR looks good — the COSTPULLER_CREDENTIALS env var is a clean solution, the debug logging is well-gated, and replacing log.Fatalf with error returns in getCachedTokenSafe is a good improvement.

One small suggestion: line 203 in gcloud_oauth.go — consider keeping "The token will not be cached." as log.Println rather than oauthDebugf, since that indicates a config issue users would want to see without needing -debug. Everything else looks good to merge.

/Ciara

[mattreid]

Thank you for the review, @ciaramulligan, it auto-dismissed your suggestion as stale when I pushed a change to revert that line and I went ahead and resolved the thread. If anything else comes to mind, let me know.

[webbnh]

There's a call to log.Println() that I think you'll want to correct. Otherwise, I just have some comments for your consideration.

[mattreid]

Thanks for the review @webbnh, I believe this new commit addresses all your feedback.

Here's the summary:

• Add COSTPULLER_GOOGLE_CREDENTIALS for Google JSON only; avoids clashing with
  GOOGLE_APPLICATION_CREDENTIALS when set.
• Set package costpullerDebug after flag.Parse; OAuth/AWS debug reads it
  instead of threading a bool through helpers.
• getToken: fall through to a single getNewToken path (bad cache path, missing
  cache, refresh failure, non-ErrNotExist open errors → browser auth).
• Replace mirrored ADC path logging with one post-load -debug summary line;
  richer but safe Fatalf context when ConfigFromJSON fails (source, type, size).

Let me know if you have additional suggestions or concerns.

[webbnh]

Looks good; just two nits.

[webbnh]

Comments like "same as the original control flow" are not useful: they will be read in the future, when memories of "the original flow" are gone (and, the fact that the flow is the same as it used to be won't be useful information).

In a similar vein, comments which describe obvious aspects of the code don't add any value above and beyond what the code already provides. So, I would omit the whole last sentence; however, if you really want to keep it, I would have it indicate that, in those three cases, a new token is produced (which is what getNewToken() does, but naming the function here isn't as helpful as describing why we're calling it).

[webbnh]

I still don't see any benefit to attempting to remove this file here.