Surface GCP SDK HTTP wire logs at V(5)

Inject an option.WithLogger slog logger bridged to the zap sink via
logr.ToSlogHandler with a V(1) shift, so the SDK's Debug-level
"api request"/"api response" records (URL, headers, full payloads)
appear only at --zap-log-level=5. Startup warning when active, since
raw insert payloads include cloud-init user-data. Note WithLogger
overrides GOOGLE_SDK_GO_LOGGING_LEVEL for this client.

Co-Authored-By: Claude <noreply@anthropic.com>

internal/provider/gcp/gcp.go

@@ -9,6 +9,7 @@ package gcp
 import (
 	"context"
 	"fmt"
+	"log/slog"
 	"strings"
 	"time"
 
@@ -16,6 +17,7 @@ import (
 	"cloud.google.com/go/compute/apiv1/computepb"
 	"github.com/go-logr/logr"
 	"google.golang.org/api/iterator"
+	"google.golang.org/api/option"
 	"google.golang.org/protobuf/proto"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 
@@ -83,12 +85,28 @@ type Provider struct {
 	api  instancesAPI
 }
 
+// wireLogger returns the slog logger handed to the SDK: its Debug-level
+// "api request"/"api response" records (slog Debug = +4 on the logr
+// scale) land at V(5) on top of the base's V(1) shift.
+func wireLogger(base logr.Logger) *slog.Logger {
+	return slog.New(logr.ToSlogHandler(base.V(1)))
+}
+
 // New builds a Provider using Application Default Credentials (workload
 // identity in-cluster, gcloud ADC locally — no key-file plumbing).
 // Deliberately untested: it dials real Google endpoints; everything below
 // it is exercised through newWithAPI.
+//
+// The injected wire logger surfaces the SDK's raw HTTP request/response
+// records at V(5); note option.WithLogger overrides the SDK's own
+// GOOGLE_SDK_GO_LOGGING_LEVEL env var, so --zap-log-level is the only knob.
 func New(ctx context.Context, pc provider.ProviderConfig) (provider.Provider, error) {
-	client, err := compute.NewInstancesRESTClient(ctx)
+	base := logf.Log.WithName("gcp").WithName("http")
+	if base.V(5).Enabled() {
+		logf.Log.WithName("gcp").Info(
+			"GCP HTTP wire logging active — request payloads include cloud-init user-data")
+	}
+	client, err := compute.NewInstancesRESTClient(ctx, option.WithLogger(wireLogger(base)))
 	if err != nil {
 		return nil, fmt.Errorf("creating GCP instances client: %w", err)
 	}