deps: migrate google-genai to 2.x (land PR #407)

[WalksWithASwagger]

Summary

Land the google-genai 1.x → 2.x major upgrade (PR #407) with a reviewed compatibility check, because google-genai is the core Gemini image provider for Rafiki.

Context

• Tracks Dependabot PR build(deps): update google-genai requirement from >=1.0.0 to >=2.16.0 #407 (google-genai >=1.0.0 → >=2.14.0).
• Highest-blast-radius runtime dependency: the default model path (gemini-2.5-flash-image) and provider code depend on this SDK. A silent breaking change here breaks generation.
• Precedent: deps: migrate OpenAI provider to python SDK 2.x (land PR #374) #392 migrated the OpenAI provider to SDK 2.x as a dedicated, reviewed issue rather than a blind Dependabot merge.

Acceptance Criteria

• Review the google-genai 2.x changelog for breaking changes to client construction, request/response shapes, and error types used by the provider.
• Provider code and any typed response handling updated for 2.x if needed.
• Full test gate green on the PR head (up-to-date with main).
• A dry-run generation path is exercised (no provider spend / no committed image) to confirm the SDK surface still resolves.
• npm run verify and npm run verify:security pass.

Notes

• needs-human: this is a core-runtime major; do not merge without maintainer review. Part of the Python-runtime-majors batch in deps: batching and compatibility plan for the 13 open PRs (corrects #308 snapshot) #420 (sequence: this → mcp 2.x build(deps): update mcp requirement from >=1.0.0 to >=2.0.0 #410 → tenacity 9.x build(deps): update tenacity requirement from >=8.0.0 to >=9.1.4 #408).

[WalksWithASwagger]

google-genai 1.x → 2.x: review-ready PR opened

PR #429 (codex/deps-genai2) — supersedes Dependabot #407.

Diagnosis of #407's CI failure: it was a stale hashed-lock, not a code/API break. #407 bumped only requirements.txt (google-genai >=1.0.0 → >=2.16.0) and left requirements-ci.txt pinning google-genai==2.12.1 (< 2.16.0). The test job's "Check Python CI lock" step (npm run lock:python-ci + git diff --exit-code) regenerates the lock and fails on the resulting diff. (The GitHub Actions log API was rate-limiting HTTP 403 throughout, so this was confirmed structurally, not from the raw log.)

What changed in #429

• requirements.txt: google-genai>=1.0.0 → >=2.16.0
• requirements-ci.txt: regenerated with the repo's exact toolchain (pip-compile 7.6.0 under Python 3.11.10, same --pip-args targeting manylinux_2_17_x86_64 / cp311). Header byte-identical; delta limited to google-genai 2.12.1→2.16.0 and its transitive google-auth 2.55.2→2.56.2.
• No provider code changes. The repo already ran on google-genai 2.x (the old >=1.0.0 floor resolved to 2.12.1); 2.16.0 preserves the entire API surface lib/providers/gemini.py uses (verified by introspection: genai.Client, types.ImageConfig, types.GenerateContentConfig{response_modalities,image_config}, models.generate_content, response.parts, Part.inline_data, Part.as_image).

CI status (PR #429): ✅ test pass (2m40s — the gate that fails on #407), ✅ secret-scan pass, ✅ Analyze/CodeQL/dependency-review pass; policy/review skipped as normal.

⚠️ LIVE GENERATION DRY-RUN BY MAINTAINER REQUIRED BEFORE MERGE — offline CI cannot verify the provider. The offline test suite mocks the provider and only exercises google.genai importability + the no-API-key early-return; it never calls generate_content / response.parts / Part.as_image(). This is the highest-blast-radius dependency in the repo. A maintainer must run one real Gemini image-generation dry-run (live GOOGLE_API_KEY) before merging. No live provider call, image, or spend was made here.

Blockers: none. (A local mac-arm64 cross-platform resolve reported pillow==12.3.0 "not found" for the manylinux/cp311 target — a pre-existing pin I did not touch; main's CI and PR #429's test job both install it fine on Linux, so it is a local-vantage artifact only.)

Do not auto-merge. Review-ready only. #407 left open for a maintainer to close in favor of #429.