feat(providers): Gemini CLI provider — ModelProvider.GEMINI (#660)

* feat(providers): Gemini CLI provider — ModelProvider.GEMINI

Mirrors the grok blueprint with source-verified divergences (all facts
pinned against google-gemini/gemini-cli @ 9681621c): no refresher
daemon — Google's refresh tokens are reusable, so the RO host mount is
COPIED to a writable container-local ~/.gemini and each container
refreshes in-process independently (the write-back crash risk on RO
never triggers); settings.json renders security.auth.selectedType
'oauth-personal', experimental.enableAgents=false (subagent ban),
autoConfigureMemory=false with a bounded heap; tool scoping rides the
tiered TOML Policy Engine (deny-only rules that yolo mode structurally
cannot beat); gemini -p with --output-format stream-json; usage parsed
from the run's own stdout stats — the adversarial pass caught the
parser reading the json-mode nested shape while the entrypoint runs
stream-json's FLAT shape (every real run would have priced $0 forever,
hidden by fixtures sharing the assumption) — now flat-primary with the
nested shape as cited fallback; rate-limit classified from structured
error.type only (model-echo immune), native exit 41 auth passthrough;
per-model pricing for the three GA models; migrations 084 (enum) + 085
(seed) complete the 082-085 finale chain. V1 excludes interactive
intake/secretary. Stack-merge required two behavior-preserving
complexity refactors in the shared park/usage plumbing (a park-pair
loop; a usage-reader dispatch dict).

* fix(providers): route gemini usage read through the containment barrier

Mirrors the codex/grok fix — _gemini_usage_json now delegates to
_read_usage_json_contained, so CodeQL's path-injection alert on the
gemini read is resolved by the same resolve-and-contain guard.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

docker-compose.yml

@@ -405,6 +405,21 @@ services:
     depends_on:
       - agent-base-image
 
+  # ==========================================================================
+  # Agent Gemini Image Builder (Google Gemini via the official gemini CLI).
+  # One-shot delivery roles only (V1) — no interactive prompter/secretary
+  # variant exists for Gemini yet, contrast the Grok images above.
+  # ==========================================================================
+  agent-gemini-image:
+    build:
+      context: .
+      dockerfile: docker/agent-gemini.Dockerfile
+    image: roboco-agent-gemini
+    entrypoint: ["/bin/sh", "-c", 'echo "Agent Gemini image built"']
+    restart: "no"
+    depends_on:
+      - agent-base-image
+
   # ==========================================================================
   # Sandbox PG Image Builder (kitchen-sink postgres for parameterized dev DBs)
   # Only pulled by the provisioner when a venture requests pg extensions; bare
@@ -491,6 +506,10 @@ services:
       # ChatGPT-subscription auth (host ~/.codex) for Codex-CLI agents — same
       # shape as ROBOCO_HOST_GROK_DIR. Run `codex login` on the host.
       ROBOCO_HOST_CODEX_DIR: ${ROBOCO_HOST_CODEX_DIR:-/home/renzof/.codex}
+      # OAuth login (host ~/.gemini) for Gemini-CLI agents — the orchestrator
+      # mounts <dir>/oauth_creds.json (read-only) into each Gemini agent. Run
+      # `gemini` interactively once on the host to produce it.
+      ROBOCO_HOST_GEMINI_DIR: ${ROBOCO_HOST_GEMINI_DIR:-/home/renzof/.gemini}
       ROBOCO_HOST_DATA_DIR: ${ROBOCO_HOST_DATA_DIR:-/volume1/roboco/data}
       # Public base URL for commit-trailer links. Default 127.0.0.1 produces
       # unusable links in commit message bodies; set to NAS LAN IP so
@@ -690,6 +709,14 @@ services:
       # the orchestrator auto-refreshes the access token in place
       # (codex_auth.refresh_if_stale); each agent's own mount stays read-only.
       - ${ROBOCO_HOST_CODEX_DIR:-/home/renzof/.codex}:${ROBOCO_HOST_CODEX_DIR:-/home/renzof/.codex}
+      # OAuth login for Gemini-CLI agents — mount the host ~/.gemini at the
+      # SAME host path the orchestrator passes to each Gemini agent's `-v`, so
+      # its oauth_creds.json exists() check passes here AND the agent bind
+      # resolves on the host. Read-ONLY: unlike grok's single-use SuperGrok
+      # token, Google's OAuth refresh token is reusable and refreshed
+      # IN-PROCESS by each agent container's own CLI — never by the
+      # orchestrator — so no read-write access is needed here.
+      - ${ROBOCO_HOST_GEMINI_DIR:-/home/renzof/.gemini}:${ROBOCO_HOST_GEMINI_DIR:-/home/renzof/.gemini}:ro
       # Shared config directory for MCP configs (writable)
       - ${ROBOCO_DATA_DIR:-./data}/mcp-configs:/app/mcp-configs
       - ${ROBOCO_DATA_DIR:-./data}/vault:/app/vault
@@ -704,6 +731,9 @@ services:
       - ${ROBOCO_DATA_DIR:-./data}/grok-usage:/data/grok-usage
       # Per-agent CODEX usage capture — same shape as grok-usage above.
       - ${ROBOCO_DATA_DIR:-./data}/codex-usage:/data/codex-usage
+      # Per-agent GEMINI usage capture: each Gemini agent writes usage.json
+      # under <agent_id>/; the finalizer reads the captured tokens/cost back here.
+      - ${ROBOCO_DATA_DIR:-./data}/gemini-usage:/data/gemini-usage
       # Persistent logs — survive `docker compose down/up`. Orchestrator and
       # each spawned agent write structured logs here so we can audit past
       # runs instead of relying on ephemeral `docker logs`.