Support Claude on Vertex AI in the Claude engine (engine.auth provider: gcp) #71985

Claude is officially available on Google Vertex AI (Google docs), and Claude Code supports it with CLAUDE_CODE_USE_VERTEX=1 (Claude Code docs). In gh-aw, the Gemini engine can already use Vertex through engine.auth (github-oidc / provider: gcp, #48185). The AWF Vertex adapter also proxies the Claude routes as-is, so most of the pieces are in place.

I tried to use Claude on Vertex from engine: claude, authenticating with GCP WIF instead of an API key. With provider: gcp the workflow compiles, but it doesn't run, for three reasons:

1. ANTHROPIC_API_KEY is still required by the secret check, so the run fails before the agent starts, even though no Anthropic key is used.
2. No Vertex environment is set, so Claude Code goes to the Anthropic API.
3. The adapter returns a retryable 503 until its first token exchange finishes, but CLAUDE_CODE_MAX_RETRIES=0 makes Claude Code exit right away.

After removing the secret check from the lock file by hand and adding this engine.env, requests reach Vertex. The remaining failure is in the api-proxy and is described in #71987.

CLAUDE_CODE_USE_VERTEX: "1"
CLAUDE_CODE_SKIP_VERTEX_AUTH: "1"       # the api-proxy adds auth
ANTHROPIC_VERTEX_BASE_URL: "http://172.30.0.30:10004/v1"
ANTHROPIC_VERTEX_PROJECT_ID: <project>
CLOUD_ML_REGION: global
CLAUDE_CODE_MAX_RETRIES: "8"

Could this be supported the same way as Gemini on Vertex?

1. Add isClaudeVertexWIF with the same conditions as isGeminiVertexWIF.
2. In that case, don't require ANTHROPIC_API_KEY, as already done for Anthropic WIF (claudeSkipsStaticSecret, Compiler: extend engine.auth for Anthropic Workload Identity Federation; gate ANTHROPIC_API_KEY validation when WIF configured #35561).
3. In buildClaudeCommandEnv, set the Vertex values above after engine.env is applied.
   • If the compiler owns the URL, add VertexLLMGatewayPort = 10004 in pkg/constants/constants.go and use llmGatewayBaseURL(constants.VertexLLMGatewayPort, workflowData) + "/v1". Verify proxy bypass and reachability for each supported sandbox topology; the hard-coded IP above is only the tested setup.
   • Take the location from auth.location; global is the location verified here. Check availability for the selected Claude model rather than reusing Gemini's regional default.
   • FilterEnvForSecrets can strip the default Anthropic secret expression once it is no longer required. Verify that this mode emits no Anthropic key or direct-API routing, even if an unrelated Anthropic key exists on the runner. Keep the GCP credentials inside the sidecar.
4. Let the first request wait out the 503, either with the CLI's default retries or with a retry in the harness.
5. Add compiler and lock-file tests: no ANTHROPIC_API_KEY requirement, correct Vertex URL/project/location after environment merges, startup survives a pending token, and existing Anthropic API-key/WIF modes are unchanged. Document Model Garden enablement and any required VPC-SC ingress.

This is a compiler request in pkg/workflow/claude_engine.go, not a firewall implementation request. The proxy bug in #71987 must be fixed separately. I haven't yet completed an end-to-end inference run through gh-aw.

Related: #48185, #61758, #35561, #71987, #71986