agent-platform-migrate-from-ai-studio: service account key download and org policy disablement in the OpenClaw setup

## Summary

The OpenClaw section of `skills/cloud/agent-platform-migrate-from-ai-studio/SKILL.md` instructs the agent to create a
service account key, copy the private key to a Compute Engine VM, and point `GOOGLE_APPLICATION_CREDENTIALS` at it. When
the organization policy that blocks key creation is enforced, the skill instructs the agent to pause and prompt the user
to turn that policy off.

The same file, 150 lines earlier, already documents the correct approach for this exact runtime. A separate skill in this
repository states the opposite rule in explicit terms. The step is also unnecessary, because the VM described has an
attached service account and resolves Application Default Credentials from the metadata server without a key.

A second, unrelated defect in the same section is covered at the end: the command that reads the project number reads the
project ID instead.

## 1. The skill contradicts its own guidance

`SKILL.md` lines 111 to 124, under **Service Auth**:

> When running your application on Google Cloud infrastructure such as a Compute Engine VM, authenticate using the
> machine's attached Service Account.

```bash
gcloud projects add-iam-policy-binding "{project_id}" \
--member="serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com" \
--role="roles/aiplatform.user"
```

The OpenClaw section then relies on that section. `SKILL.md` line 252:

> Ensure that the runtime where OpenClaw is running (e.g. GCE VM with Service Account) has the `aiplatform.user` IAM role
> - see Authentication and Authorization section above.

Having established an attached service account with the required role, the next step creates a long-lived private key for
that same identity and moves it over the network. `SKILL.md` lines 271 to 278:

```bash
mkdir -p ~/.config/gcloud
gcloud iam service-accounts keys create ~/.config/gcloud/application_default_credentials.json \
--iam-account="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
```

> From outside the GCE instance, generate `GOOGLE_APPLICATION_CREDENTIALS` using the Google Cloud project number. Then,
> `scp` these credentials to the GCE VM.

On a VM with an attached service account, Application Default Credentials are served by the metadata server. No key is
required for the credential to resolve.

## 2. Another skill in this repository states the opposite rule

`skills/cloud/google-cloud-storage-basics/references/mcp-usage.md` lines 147 to 156:

> The Toolbox uses Application Default Credentials (ADC) in every environment: locally via the command below, on GCP
> compute via the attached service account, and elsewhere (CI, on-prem) via workload identity federation. **Never
> download a service-account key file or set `GOOGLE_APPLICATION_CREDENTIALS` to one** — key files are a security
> liability and are never needed for the Toolbox.

Two skills in the same repository give a reader opposite instructions for the same decision.

## 3. The target path collides with the file gcloud manages

The key is written to `~/.config/gcloud/application_default_credentials.json`. That is the well-known ADC path written by
`gcloud auth application-default login`. Placing a downloaded service account key there overwrites whatever user
credential is present and makes the substitution invisible to anything that later reads ADC from the default location.

The identity involved is the Compute Engine default service account, which is the identity every VM in the project runs
as unless configured otherwise. A downloaded key for it is a long-lived, portable credential for that identity, valid
until it is explicitly deleted.

## 4. The skill instructs the agent to have a security control turned off

`SKILL.md` lines 280 to 285:

> **Troubleshooting Policy Constraints on New Orgs**: New Google Cloud organizations (created on or after May 4th, 2024)
> enforce a legacy Organization Policy, restricting Service Account Key Creation. To complete this step, this Org Policy
> must be temporarily disabled. An Organization Policy Admin must set this policy to Inactive.
> To the agent: Check if this policy is enforced, and if it is: pause, and prompt the user to disable it at this Console
> link: https://console.cloud.google.com/iam-admin/orgpolicies

`constraints/iam.disableServiceAccountKeyCreation` is part of the secure-by-default set applied to organizations created
on or after May 3, 2024. It is enforced specifically to prevent the action this step requires.

Two points on the framing:

- The policy is described as "legacy". The constraint is a current secure-by-default control, not a deprecated one.

- The date given is May 4th, 2024. The documented date is May 3, 2024.

Instructing an autonomous agent to prompt an administrator to disable an organization-wide security control, in order to
complete a step that the attached service account already satisfies, is worth reconsidering independently of the wording.

## 5. Separate defect: the project number command reads the project ID

`SKILL.md` lines 264 to 269:

```bash
export PROJECT_NUMBER=$(curl "http://metadata.google.internal/computeMetadata/v1/project/project-id" -H "Metadata-Flavor: Google")
echo "Project number: $PROJECT_NUMBER"
```

`project/project-id` returns the project ID. The project number is served by `project/numeric-project-id`.

The value is then interpolated into a service account address that requires the number:

```
${PROJECT_NUMBER}-compute@developer.gserviceaccount.com
```

With the project ID substituted, that address does not resolve to the Compute Engine default service account, so the
in-VM path of this step fails as written. The out-of-VM branch immediately above it is correct, since it uses
`--format="value(projectNumber)"`.

Suggested correction:

```bash
export PROJECT_NUMBER=$(curl "http://metadata.google.internal/computeMetadata/v1/project/numeric-project-id" -H "Metadata-Flavor: Google")
```

## Suggested change

For the OpenClaw section, on a VM that already has the attached service account established earlier in the skill:

- Remove the `gcloud iam service-accounts keys create` step and the instruction to `scp` the key to the VM.

- Remove `GOOGLE_APPLICATION_CREDENTIALS` from the `openclaw.json` example at line 304. `GOOGLE_CLOUD_PROJECT` and
`GOOGLE_CLOUD_LOCATION` are sufficient when ADC resolves from the metadata server.

- Remove the organization policy note, which exists only to support the removed step.

- For a workstation outside Google Cloud, direct the reader to `gcloud auth application-default login`, matching
**Option 2 - Manual Setup** at line 96 of the same file.

- For a non-Google-Cloud host that needs a workload identity, direct the reader to workload identity federation,
matching the guidance already given in `google-cloud-storage-basics/references/mcp-usage.md`.

A minor observation on the same block, offered without a strong claim: the value at line 304 is the literal string
`~/.config/gcloud/application_default_credentials.json`. Tilde expansion is performed by the shell, not by the consumer
of an environment variable read from a JSON file, so this path may not resolve even where the intended approach is kept.

## References

- Compute Engine, view and query VM metadata: https://docs.cloud.google.com/compute/docs/metadata/querying-metadata

- Managing secure-by-default organization resources:
https://docs.cloud.google.com/resource-manager/docs/secure-by-default-organizations

- Compute Engine default service account:
https://docs.cloud.google.com/compute/docs/access/service-accounts#default_service_account

## Environment

Observed at commit `8f57a0d`, on `main`.

Read skills/cloud/agent-platform-migrate-from-ai-studio/SKILL.md, especially the Service Auth and OpenClaw sections, then compare the ADC guidance in skills/cloud/google-cloud-storage-basics/references/mcp-usage.md. Update the documented authentication paths and project-number lookup, and verify that the OpenClaw example no longer directs VM users toward downloaded keys or policy disablement.

Written by the indexing model from the issue text.