Can't create GCE spot instance

[resistor]

Working configuration is here: https://github.com/CHERIoT-Platform/llvm-project/blob/7d53615ec4071f877d008b87a0559af45e6dc88b/.cirrus.yml

When I add spot: true to the gce_instance, the task always fails with this error:
Failed to start: INVALID_ARGUMENT: Operation with name "operation-1735544576984-62a77f600c41f-024a825e-90f77cd1" failed with status = HttpJsonStatusCode{statusCode=PERMISSION_DENIED} and message = FORBIDDEN