feat(infra): gemini credential plumbing, behind enable_gemini

[gedaiu]

Everything a gemini-model agent run needs, behind one enable_gemini flag: the lore-gemini-api-key GSM container (secrets.tf), the GEMINI_API_KEY entry in agent-secrets (ai-agents.tf), and the gemini model family in the central cluster-agent's catalog render (lore-platform.tf). The three ride the same variable deliberately — listing a family whose key the Secret does not hold would render pods that die CreateContainerConfigError on their secretKeyRef, so the map entry and the key must move together or not at all.

The subsystem side needs nothing: I verified in ai-agent-subsystem (v0.10.x) that gemini-* models already route to the GeminiAgent adapter running the official @google/gemini-cli, installed per run, and that the CLI reads the standard GEMINI_API_KEY env — exactly the key the catalog render mounts for gemini-family models.

The key itself is created in the GCP project via gcloud services api-keys, restricted to the Generative Language API, so usage bills to the project and no console visit is needed — the commands are in docs/managing-secrets.md, and lore-gemini-api-key joins seed-secrets.sh's OPTIONAL list. No secret material appears anywhere in this diff.

With the flag off — the default, and what terraform.tfvars.example ships — nothing changes anywhere: gemini recipes keep being refused with the reason visible on the /agents Rollout column, and dispatch keeps falling back to the org default per #1707.

Operator runbook after merge (also in the doc): terraform apply, run the three gcloud commands to create and seed the key, then re-save each gemini-model definition on /agents — a refusal is acked past permanently, so the re-save is what emits the catalog event that makes the sync loop re-render and apply the CRs.

Verified: terraform validate clean, both chart render checks pass, repo lint zero.

🤖 Generated with Claude Code

[lore-agent]

Lore is reviewing this PR — c131b023-11f0-4893-a991-1fa2f2b144a8.

Reply to any review comment to discuss or approve a fix (e.g. "ok, fix it"). Comment @lore review to re-run the review.

[github-actions]

🔍 Lore Spec Impact

Examined 7 changed file(s): 0 had graph data (no coupling found), 7 had none — no ingested test run covers them, so this check cannot speak for them.

_{Deterministic · graph @ 6c281e7 (projected 2026-09-01) · no tests run by this check}

[lore-agent]

Lore code-review run failed (failed — node "review" failed: Station or AgentDefinition not found — Unrecognized failure — see the Event Timeline metadata and agent pod logs.) — c131b023-11f0-4893-a991-1fa2f2b144a8. Comment @lore review to re-run the review.