build(deps): pin cloud-commitments-go to c5cf5c7 (dedupe fixes)

[cristim]

Summary

Re-pins all four cloud-commitments-go modules (pkg, providers/aws, providers/azure, providers/gcp) from fe940a89483d to v0.0.0-20260928205306-c5cf5c7fbad8, which is current cloud-commitments-go main (c5cf5c7f, after LeanerCloud/cloud-commitments-go#147). All four resolve to the same pseudo-version.

Included cloud-commitments-go changes (LeanerCloud/cloud-commitments-go)

• #135 sec(exchange): honor ExpectedAccount on the dependency-injected path, so an RI exchange fails closed when the injected client targets a different account than expected
• #141 fix(recfilter): count queued AWS RIs as existing commitments, so recommendations no longer suggest re-buying capacity that is already queued for purchase
• #143 fix(recfilter): count pending and unknown commitment states in dedupe, so in-flight or unrecognised commitment states are not treated as absent (no duplicate purchase suggestions)
• #137, #140 docs only; #147 bumps the providers' internal pkg pin

Code changes

None. The diff is go.mod and go.sum only; no call site needed updating for the #135 or #143 API changes.

Verification (GOWORK=off GOTOOLCHAIN=go1.26.6)

• go build ./...: ok
• go vet ./...: ok
• go test -race -short ./...: ok
• go mod tidy -diff: empty
• c5cf5c7fbad8 is identical to cloud-commitments-go main (GitHub compare: 0 ahead, 0 behind)

Summary by CodeRabbit

• No user-facing changes
  • This update does not change the app’s visible features or behavior.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: LeanerCloud/cloud-commitments-mcp/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 8018550b-daf9-4e51-9880-55bbf4dc0b28

📥 Commits

Reviewing files that changed from the base of the PR and between 2d9a95f and 4cbd9b5.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The pkg and AWS, Azure, and GCP provider modules now use version v0.0.0-20260928205306-c5cf5c7fbad8 in place of v0.0.0-20260928132534-fe940a89483d.

Changes

Go module pins

Layer / File(s)	Summary
Update module version pins go.mod	The pkg and AWS, Azure, and GCP provider module pins use the newer pseudo-version.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 4cbd9

The dependency pins and checksums are consistent, and no actionable issue is evident in this change. It is ready to merge after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency pin update and the deduplication fixes. It matches the main changes in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Orchestrator-verified release plumbing: go.mod/go.sum only; pkg and providers/{aws,azure,gcp} all pinned to v0.0.0-20260928205306-c5cf5c7fbad8 (go main after #147), shipping the dedupe/money fixes #128 #131 #133 #135 #141 #143. The author verified build, vet, go test -race -short and tidy -diff with GOWORK=off GOTOOLCHAIN=go1.26.6; no code changes were needed.