Persistent PERMISSION_DENIED errors for gcloud commands despite comprehensive troubleshooting

### What happened?

I'm consistently encountering PERMISSION_DENIED errors when trying to run specific gcloud commands like gcloud projects get-iam-policy and gcloud storage ls gs://. For example, running gcloud projects get-iam-policy $(gcloud config get-value project) results in a PERMISSION_DENIED error. The same error occurs with gcloud storage ls gs://.

### What did you expect to happen?

Since the service account has the correct IAM roles assigned and the necessary APIs are enabled, I expect these gcloud commands to run successfully without any errors. This should include being able to retrieve IAM policies and list Cloud Storage buckets.

### Client information

* **CLI Version:** 0.1.9
* **Git Commit:** 34935d6
* **Operating System:** android v22.15.1
* **Sandbox Environment:** no sandbox
* **Model Version:** gemini-2.5-flash
* **Memory Usage:** 92.9 MB

### Login information

* Service Account: gemini-cli-auth@glass-approach-464708-h0.iam.gserviceaccount.com
* Google Cloud Project ID: gemini-cli-project (Project Number: 681255809395)
* Authentication Method: I'm using a service account key (JSON) and authenticating with gcloud auth activate-service-account.

### Anything else we need to know?

I've performed extensive troubleshooting and verified all potential causes, but the issue persists. Here's what I've tried and confirmed:
* IAM Permissions Verification:
* The "Editor" role was granted to the service account (gemini-cli-auth@glass-approach-464708-h0.iam.gserviceaccount.com) at the project level.
* Based on CLI prompts, specific roles (roles/iam.securityReviewer for get-iam-policy and roles/storage.objectViewer for storage ls) were explicitly added and confirmed to be assigned to the service account, even though the "Editor" role should include these.
* I allowed sufficient time (multiple hours over several days) for permission propagation after each change.
* Verification: I've visually confirmed in the Google Cloud Console IAM screen that these roles are actively assigned to the service account.
* API Enablement Verification:
* Both the "Cloud Resource Manager API" (needed for get-iam-policy) and the "Cloud Storage API" (needed for storage ls) are confirmed as Enabled for gemini-cli-project in the Google Cloud Console. Both show a "Manage" button and display traffic graphs.
* gcloud CLI Configuration and Authentication:
* gcloud config list output confirms the account and project are set correctly (account = gemini-cli-auth@glass-approach-464708-h0.iam.gserviceaccount.com, project = gemini-cli-project).
* I ran gcloud auth revoke --all to clear old credentials.
* A new service account key file (JSON) was generated from the Google Cloud Console.
* The new key file was successfully activated in Termux using gcloud auth activate-service-account --key-file="...". The output confirmed "Activated service account credentials", indicating the key file is not corrupted.
* Network Connectivity:
* I successfully ran ping google.com from Termux, showing 0% packet loss and stable response times, which confirms robust internet connectivity.
* I do not have any proxy settings configured in Termux that could interfere with gcloud communication.
* Organization Policies:
* This is a personal Google Cloud project (using a @gmail.com account) and is not part of any organization. Therefore, organizational policies restricting access are not applicable.
Additional Notes:
* The gcloud version command runs successfully, indicating basic gcloud CLI functionality is working.
* The issue appears to be specifically with commands that require interaction with Google Cloud APIs, not a general CLI or network problem.
* I can provide screenshots of the IAM bindings and API enablement status upon request.