authenticate from ADC, drop host OAuth token mirroring

[omkargaikwad23]

Summary

agy 1.1.10 added headless auth from Application Default Credentials, so the
harness no longer needs a host OAuth token.

• Delete _mirror_agy_auth_state, which copied antigravity-oauth-token and
  installation_id out of ~/.gemini/antigravity-cli/ into every eval
  sandbox. No personal credential is staged anymore.
• _setup_auth sets AGY_ADC_AUTH=true unconditionally (not a config knob)
  and warns at setup when no ADC is readable — otherwise agy silently falls
  back to interactive OAuth and the run dies on "authentication required".
• Re-pin the shipped model to Gemini 3.1 Pro (Low): ADC is entitled to a
  smaller model set than an interactive login, and (High) is not in it.
• Fix a latent crash in _merged_env: an unquoted YAML scalar (FLAG: true)
  reached subprocess.run(env=) as a bool and raised TypeError.
• Rewrite the Authentication docs around ADC and drop the interactive-login
  prerequisites.

Unblocks unattended/CI runs, which previously required copying a personal
token into a shared environment.

Test plan

• pytest test/agy_cli_test.py — 59 pass; suite is hermetic with or
  without GOOGLE_APPLICATION_CREDENTIALS exported
• End-to-end run against Cloud SQL MCP with no OAuth token present:
  exit 0, goal_completion 2/2, trajectory_matcher 2/2, executable 2/2

[prernakakkar-google]

The current changes will not work with GKE. Please test and fix them.

[prernakakkar-google]

Description says we cannot use higher model: ```
Re-pin the shipped model to Gemini 3.1 Pro (Low): ADC is entitled to a
smaller model set than an interactive login, and (High) is not in it.

is this correct?

[omkargaikwad23]

Description says we cannot use higher model: ``` Re-pin the shipped model to Gemini 3.1 Pro (Low): ADC is entitled to a smaller model set than an interactive login, and (High) is not in it.

is this correct?

Yes, I tested using Gemini 3.1 Pro (High) and it's not supported. I have added a feature for early termination when provided model is incorrect.

[prernakakkar-google]

Description says we cannot use higher model: ``` Re-pin the shipped model to Gemini 3.1 Pro (Low): ADC is entitled to a smaller model set than an interactive login, and (High) is not in it.

is this correct?

Yes, I tested using Gemini 3.1 Pro (High) and it's not supported. I have added a feature for early termination when provided model is incorrect.

Is there a way to test it because this is main model to test.