fix(api/auth/gcp): check metadata response status when fetching GCE JWT

[alekc]

Description

Fixes #32068. Hands the metadata call to metadata.GetWithContext instead of the hand-rolled request, which covers all three defects at once: the missing status check, the io.ReadAll error ordering, and the ignored context. That package is already a direct dependency, so go.mod and go.sum are unchanged.

Behaviour that shifts because the library differs, none of it required by the issue:

• Host is 169.254.169.254 rather than http://metadata/, which relies on a .google.internal search suffix that netgo-without-cgo builds lack.
• GCE_METADATA_HOST now applies to the fetch, not just the OnGCE gate.
• Metadata calls no longer go through HTTP_PROXY, so the NO_PROXY workaround stops mattering.
• Retries on 5xx and 429: 6 attempts, about 1.2s, and the backoff respects the caller's deadline. Before this there was no timeout and no way to cancel.

The gate deliberately stays on metadata.OnGCE(): OnGCEWithContext memoizes in a sync.Once, so one caller whose context expires mid-probe would cache "not on GCE" and break every later login until the process restarts.

Out of scope: signJWT still uses context.Background(), and a 200 with an empty body still passes through as an empty token. Either can go in this PR if you prefer. command/agentproxyshared/auth/gcp/gcp.go has the same missing status check, which I can file separately.

8 new tests, the module had none. They aim the client at an httptest server via GCE_METADATA_HOST, so nothing in production code exists only for tests and the suite needs no network. I checked they fail against the unfixed code. CI likely runs none of them: API_PACKAGES in the Makefile is cd api && go list ./..., which skips api/auth/gcp as a nested module.

A changelog/<PR>.txt entry follows in a second commit.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request. Not applicable: reverting the PR is enough, there is no state or migration.
• I've documented the impact of any changes to security controls. See the behaviour changes above. Nothing about authentication, authorisation, or audit changes.

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-ui	Error		Aug 3, 2026 8:33pm

[hashicorp-cla-app]

All committers have signed the CLA.