fix(cli): the dry-run footer says Savings Plans purchasing is not implemented, but it is

[cristim]

Summary

Every dry run prints "Note: Savings Plans purchasing not yet implemented". It is implemented. createServiceClient returns a real Savings Plans client for all four Savings Plans slugs, and PurchaseCommitment issues a real CreateSavingsPlan call. The message actively misleads an operator on a money path at the exact moment they decide whether to re-run with --purchase.

Location

• cmd/multi_service_stats.go:181-185 at 3c0f8ac
• cmd/main.go:258-266 (createServiceClient)
• providers/aws/services/savingsplans/client.go:210-235 (PurchaseCommitment)

Failure scenario

An operator dry-runs --all-services, reads the footer, and re-runs with --purchase expecting Savings Plans rows to be skipped. They are not. The run buys the Savings Plans commitments the operator believed were excluded.

Evidence

if isDryRun {
    AppLogger.Println("\n💡 To actually purchase these RIs, run with --purchase flag")
    AppLogger.Println("   Note: Savings Plans purchasing not yet implemented")
}

Suggested fix

Delete the stale second line, or replace it with the count of Savings Plans recommendations that --purchase will buy.

---

Found by the 2026-09-02 codebase audit, finding A10-014, reported by one reviewer and independently confirmed by a second. Full report: docs/audits/codebase-audit-2026-09-02.md.

[cristim]

Verified after merge of #2127 at f2a3fe24f07c9dfb37b41c1dcf6a510270ac84d5.

The complete merged source tree is identical to independently reviewed ebc0eeeea271061fe1e1a50b6239af6e7a0e32e5. Built the merged commit with Go 1.26.6 in a clean isolated checkout, then ran the public CLI against RI-only and canonical mixed RI/Savings Plans CSV fixtures. Both commands exited successfully, displayed the corrected commitments footer, and omitted the obsolete claim that Savings Plans purchasing is unimplemented. Report IDs and audit records confirm dry-run behavior. Both merged-SHA CI workflows passed.

Verification used synthetic CSV inputs, scrubbed credentials and blocked provider reads. It did not exercise live cloud recommendations or purchases; CSV Savings Plans details are insufficient to claim purchase suitability. The actual-purchase branch was unchanged.

This verifies the footer correction covered by this issue. No additional product follow-up was identified by these post-merge checks.