fix: add trap to ensure temp key file removal after GCP SA key creation

scripts/gcp-setup.sh

@@ -102,6 +102,7 @@ echo "Granted objectViewer to $SA_EMAIL."
 echo ""
 echo "--- Step 9: Create and store service account key ---"
 KEY_FILE=$(mktemp)
+trap 'rm -f "$KEY_FILE"' EXIT
 $GCLOUD iam service-accounts keys create "$KEY_FILE" --iam-account="$SA_EMAIL"
 echo "Service account key created."
 
@@ -118,7 +119,6 @@ else
     --region "$AWS_REGION"
   echo "Created secret forgejo/gcs-sa-key."
 fi
-rm -f "$KEY_FILE"
 echo "Key stored in AWS Secrets Manager, local copy deleted."
 
 # --- Storage Transfer ---