Headless / Vertex orchestrator auth for company environments #4

Motivation: the fork is being trialed in a company environment where interactive OAuth isn't viable (per upstream ToS rules) and headless authentication via Vertex AI or `GEMINI_API_KEY` is required. Currently `gemini-fork` only ships with the OAuth path documented; the harness can only automate setup + analyze, not the orchestrator loop itself.

Goal

Document and validate a headless orchestrator auth path:

1. `GEMINI_API_KEY` (paid) — set env var, no auth dance. Verify the fork picks it up cleanly and bypasses OAuth.
2. Vertex AI ADC — `gcloud auth application-default login` once, then service-account / project-bound auth at runtime. Document required env vars (`GOOGLE_CLOUD_PROJECT`, `GOOGLE_CLOUD_LOCATION`, etc.) and how to verify the orchestrator is hitting Vertex.

Updates to ship

• Working Vertex auth setup section in `FORK-GUIDE.md` (currently the file points at this issue as `#X`).
• Harness sandbox `.gemini/settings.json` template variants for each auth mode.
• Test-harness sub-command (e.g. `gemini-fork-harness new --auth=vertex`) that drops the right `settings.json` shape into the sandbox.
• Headless run mode: `gemini-fork -p` non-interactive variant for scenarios. Once orchestrator auth is headless, the entire scenario run cycle can be automated.

ToS reminder

OAuth (default `oauth-personal`) must NOT be used for headless/automation. Code Assist telemetry hardcodes `isAgentic: true` and the geminicli.com ToS forbids it for third-party tools. The two acceptable paths are `GEMINI_API_KEY` and Vertex AI.

Refs #1.