fix(gke): pin proven Vertex tool loop

[fmind]

What

Pin the optional GKE/Vertex path to gemini-3.5-flash and add a fail-closed live acceptance smoke for the exact source, image, gateway, model, synthetic tool-result turn, and read-only A2A/MCP retrieval path.

Why

The current pinned agentgateway release adds an empty text part beside Vertex function responses. Gemini 3.6 rejects that translated follow-up request even though a one-turn text probe succeeds; Gemini 3.5 completes the same tool loop. Without a two-turn acceptance boundary, the optional cloud lab can appear healthy while its core agent path is broken.

How

• Keep native direct ADK examples on Gemini 3.6 and compatibility-pin only the GKE gateway path to Gemini 3.5.
• Synchronize all three GKE model owners, learner docs, maintainer guidance, freshness review, and changelog.
• Add mise run gke:smoke, which rejects dirty or mismatched source/live state, proves the exact deployed image and gateway pair, exercises a forced two-turn function response, then verifies one stable-seed get_incident call through A2A and the gateway metric delta.
• Add an offline fake harness covering success, non-zero counters, protocol/evidence failures, model/image/context drift, reconciliation drift, dirty source, unique request IDs, and port-forward cleanup.

Test Plan

• mise run format
• mise run check
• mise run test — 630 passed; 95.53% branch coverage
• mise run scan — gitleaks and Trivy clean
• Run KUBECONFIG=<isolated-config> mise run gke:smoke against the exact merged main commit before release.
• I added no credentials, generated reports, or unrelated changes.

Screenshots

Not applicable; rendered documentation is covered by the Zensical build and convention checks.