Dry-run first

Before you change anything, read the plan. The --dry-run flag records every REST call and gcloud shell-out and prints them without sending traffic:

cargo run -p cli -- ops gcp setup --project-id your-project-id --dry-run