Gmail connector: untrash_message fails with "no permission" even though trash_message succeeds

## Bug: Gmail connector `untrash_message` fails with "The caller does not have permission" even though `trash_message` on the same message succeeds

**Environment:** Claude Code, first-party Gmail connector (Customize → Connectors → Gmail)

**Steps to reproduce:**
1. Connect the Gmail connector (disconnect + reconnect if it was previously connected with a narrower scope). The OAuth consent URL includes `https://www.googleapis.com/auth/gmail.modify` in its scope list.
2. Call `trash_message` on any message ID. Succeeds — a follow-up `get_message` shows `TRASH` added to `labelIds`.
3. Immediately call `untrash_message` on the *same* message ID.

**Expected:** the message is restored from Trash (analogous to Gmail's own "Move to Inbox" action).

**Actual:** the call fails with:
```
The caller does not have permission
```

**Reproduced twice in a row**, immediately after `trash_message` succeeded on the same message — which rules out a missing/stale OAuth scope, since a sibling write operation on the identical message worked a moment earlier with the same grant.

**Workaround found and verified:** calling `unlabel_message` with `labelIds: ["TRASH"]`, followed by `label_message` with `labelIds: ["INBOX"]`, achieves the same net effect as untrash (confirmed via `get_message` read-back both times) — both calls succeed with no error.

**Conclusion:** `label_message` / `unlabel_message` / `trash_message` all work correctly with the granted scope; `untrash_message` specifically appears to have a bug independent of OAuth scope. `untrash_thread` was not directly tested but is presumably affected by the same underlying issue since it's in the same tool family.

No source file or test is named in the report. Start by reproducing the sequence, then locate the Gmail connector implementations for untrash_message, trash_message, unlabel_message, and label_message and compare their requests; done means untrash_message restores the message without the permission error, with regression coverage for the reported behavior.

Written by the indexing model from the issue text.