feat(gemini): add Google Vertex AI Workload Identity Federation auth

[Copilot]

Enterprise Gemini workloads on Vertex AI / Gemini Enterprise Agent Platform require keyless authentication via Google Cloud WIF rather than a static GEMINI_API_KEY. This adds provider: google support to engine.auth, aligned with the existing Anthropic WIF pattern for Claude.

Changes

Core auth plumbing

• EngineAuthConfig — adds GoogleWorkloadIdentityProvider, GoogleServiceAccount, GoogleProject, GoogleLocation fields
• applyEngineAuthEnv — emits AWF_AUTH_GOOGLE_WORKLOAD_IDENTITY_PROVIDER, AWF_AUTH_GOOGLE_SERVICE_ACCOUNT, AWF_AUTH_GOOGLE_PROJECT, AWF_AUTH_GOOGLE_LOCATION for the AWF api-proxy sidecar
• engine_config_parser — parses workload-identity-provider, service-account, project, location from engine.auth

Gemini engine

• isGeminiVertexWIF — detects type: github-oidc + provider: google
• GetRequiredSecretNames — skips GEMINI_API_KEY when WIF is active
• GetSecretValidationStep — returns empty step (no static key to validate)
• GetExecutionSteps — sets GOOGLE_GENAI_USE_VERTEXAI=1, GOOGLE_CLOUD_PROJECT, GOOGLE_CLOUD_LOCATION; omits GEMINI_API_KEY

Schema & docs

• JSON schema extended with the four new engine.auth Google WIF fields
• auth.mdx adds a full Google WIF section with field table and emitted env vars
• engines.md Gemini row now lists the keyless alternative

Usage

permissions:
  contents: read
  id-token: write

engine:
  id: gemini
  auth:
    type: github-oidc
    provider: google
    workload-identity-provider: projects/123456789/locations/global/workloadIdentityPools/github-pool/providers/github
    service-account: gemini-sa@my-project.iam.gserviceaccount.com
    project: my-project
    location: us-central1  # optional, defaults to us-central1

When active, GEMINI_API_KEY is not required and the Gemini CLI is switched to Vertex AI backend via GOOGLE_GENAI_USE_VERTEXAI=1.

• Fixes GEMINI ENGINE - Add new authentication methods #47053

[github-actions]

🤖 PR Triage

Field	Value
Category	feature
Risk	🟡 Medium
Priority Score	28/100
Score Breakdown	Impact: 15, Urgency: 8, Quality: 5
Action	defer — WIP draft; wait for agent to complete work

No files changed yet. Defer until the agent finalizes the implementation.

Generated by 🔧 PR Triage Agent · sonnet46 · 26.8 AIC · ⌖ 4.99 AIC · ⊞ 5.7K · ◷

[github-actions]

Excellent work! 🤖 This PR cleanly adds Google Vertex AI Workload Identity Federation support to the Gemini engine, aligned with the existing Anthropic WIF pattern.

What's great:

• Comprehensive integration and unit test coverage (8 focused test cases covering happy path, missing auth, provider detection, secret handling, and env var emission)
• Clear documentation with field tables, usage examples, and emitted env vars in auth.mdx
• Schema extended with four new Google WIF fields (workload-identity-provider, service-account, project, location)
• Well-structured code changes across auth plumbing, parser, and Gemini engine implementation
• Proper handling of optional location field with sensible default (us-central1)
• Fixtures and integration test ensure the entire compilation pipeline works end-to-end

Implementation highlights:

• isGeminiVertexWIF() helper correctly detects type: github-oidc + provider: google
• GetRequiredSecretNames() conditionally skips GEMINI_API_KEY when WIF is active
• Environment variable setup properly emits AWF_AUTH_GOOGLE_* vars and switches Gemini CLI to Vertex AI backend via GOOGLE_GENAI_USE_VERTEXAI=1
• Security-conscious: uses dynamic secret list to prevent raw tokens from being exposed in agent environment

This PR is ready for review and merge. 🎉

Generated by ✅ Contribution Check · sonnet46 · 61.8 AIC · ⌖ 10.5 AIC · ⊞ 6.2K · ◷