OAuth/Policy Error: "Tool execution denied by policy" prevents basic read/write tool usage

### What happened?

**What happened?**
The Gemini CLI is consistently throwing a `Tool execution denied by policy` error. This is a generalized blockade affecting all tool invocations, but it severely impacts fundamental I/O operations (file reading, file writing, and shell command execution). The environment security system actively blocks these tools, rendering file-dependent workflows and codebase context gathering completely unusable.

**What did you expect to happen?**
The CLI should successfully execute read/write file operations and shell commands when requested by the prompt. Or, otherwise, at least ask for permittion to do it (do not happen). If there is a missing scope or local configuration preventing tool usage, the CLI should output a clear, actionable error message pointing to the specific IAM permission or local `tool_execution_policy` flag, rather than a generic policy denial.

**Client information:**
- **OS:** Windows (PowerShell)
- **Auth Type:** OAuth
- **CLI Version:** 0.37.1
- **Model Version:** all of them

**Login information:**
- Authenticated via `gcloud auth application-default login` (OAuth user context).

**Anything else we need to know?**
The problem persists even after forcefully revoking and regenerating application default credentials or reinstalling gemini cli. The issue seems to stem from an overly restrictive "fail-closed" default architecture regarding tool execution in the CLI wrapper, or a severe mismatch between documented OAuth scopes and the actual Vertex AI/Google AI Studio backend requirements for Function Calling.

### What did you expect to happen?

**What did you expect to happen?**
The CLI should successfully execute read/write file operations and shell commands when requested by the prompt. If there is a missing scope or local configuration preventing tool usage, the CLI should output a clear, actionable error message pointing to the specific IAM permission or local `tool_execution_policy` flag, rather than a generic policy denial.

### Client information

**Client information:**
- **OS:** Windows (PowerShell)
- **Auth Type:** OAuth
- **CLI Version:** 0.37.1
- **Model Version:** all of them
Client Information

Run `gemini` to enter the interactive CLI, then run the `/about` command.

```console
> /about
│ About Gemini CLI │
│ │
│ CLI Version 0.37.1 │
│ Git Commit 3b2d4f100 │
│ Model Auto (Gemini 3) │
│ Sandbox no sandbox │
│ OS win32 │
│ Auth Method Signed in with Google (ramonpiacente@gmail.com) │
│ Tier Gemini Code Assist in Google One AI Pro │
│ ```

/about

### Login information

- Authenticated via `gcloud auth application-default login` (OAuth user context).

### Anything else we need to know?

The problem persists even after forcefully revoking and regenerating application default credentials or reinstalling gemini cli. The issue seems to stem from an overly restrictive "fail-closed" default architecture regarding tool execution in the CLI wrapper, or a severe mismatch between documented OAuth scopes and the actual Vertex AI/Google AI Studio backend requirements for Function Calling.