feat(provider): add Gemini CLI provider

[aurokin]

Author Note: The intent of this PR is to add Gemini CLI support to Clawpatch. I know antigravity was just announced i'll start on that next >.> . I analyzed Gemini CLI source, probed the CLI behavior directly, reviewed the implementation as it was built, and dogfooded this build while reviewing the final PR with Clawpatch using both Codex and Gemini.

Update: I can't add antimatter, going to add the feedback from the agent below the main PR

---

Summary

Adds Gemini CLI as a Clawpatch provider for map, review, revalidate, and fix workflows.

Changes

• Add gemini provider command construction and JSON envelope parsing.
• Run Gemini review/map/revalidate in --approval-mode=plan.
• Run Gemini fix in --approval-mode=auto_edit.
• Require explicit CLAWPATCH_GEMINI_TRUST_WORKSPACE=true for trusted workspace execution.
• Isolate Gemini subprocesses in a temporary HOME/XDG environment while seeding only minimal auth files.
• Gate Gemini CLI versions against GHSA-wpqr-6v78-jr5g patched ranges.
• Add an explicit warning for CLAWPATCH_GEMINI_ALLOW_UNPATCHED=1.
• Harden provider JSON fallback extraction and parallelize review prompt file loading.
• Document Gemini provider setup, security behavior, model selection, and timeout controls.

Validation

• pnpm format:check
• pnpm typecheck
• pnpm lint
• pnpm test
• pnpm build
• CLAWPATCH_GEMINI_TRUST_WORKSPACE=true node dist/cli.js doctor --provider gemini --json
• Rebuilt Clawpatch and reviewed the branch with Gemini 3.1 Flash Lite and Codex providers.

---

Why we can't add Antigravity yet

Decision note: do not implement the Antigravity provider yet.

Antigravity CLI is not ready for a Clawpatch provider vertical slice because the current verified agy 1.0.0 surface does not yet meet Clawpatch's provider contract:

No reliable machine-readable output mode is exposed. agy has --print , but no documented or local --output-format=json / structured schema flag comparable to Codex or Gemini CLI.
--print cannot take the prompt on stdin, so large Clawpatch prompts would need argv handling or temp-file indirection that Antigravity has not documented.
Auth failure is not classifiable by exit code alone: auth timeout prints an error but exits 0.
Read-only safety is not proven. The available flags are --sandbox and --dangerously-skip-permissions; there is no verified plan/read-only approval mode equivalent, and current user settings include always-proceed permissions.
Startup creates Antigravity project state before auth. Running from a temp runner directory may keep the target repo clean, but authenticated --add-dir behavior still needs proof.
There is no exposed --model flag, so Clawpatch --model behavior cannot currently be mapped cleanly.
The next step should be authenticated HITL evidence in a synthetic repo. Implementation should wait until we can prove: reliable JSON-only responses, clean target worktree behavior, controlled read-only/write modes, target-file access through --add-dir, timeout behavior, and any supported model-selection path.